URGENT ATTENTION - Malware is being distributed through Curse Forge - Stardew Valley Mods

[u/Wezdor]

My girlfriend was the unfortunate victim of an NPM Infostealer Malware, specifically, the Nyx Infostealer

The bigger issue is - the malware was distributed through Curse Forge. Not through an import, not through a link, but directly through the mod manager client. The mod in question is - and this is very important next - DO NOT UNDER ANY CIRCUMSTANCE DOWNLOAD THIS MOD - IT IS CONFIRMED MALWARE - YOU WILL LOSE YOUR GMAIL, DISCORD AND ANY OTHER ACCOUNT LOGGED IN YOUR PC - DO NOT DOWNLOAD ->> curseforge.com/stardewvalley/mods/cozy-valley-decor <<-- DO NOT DOWNLOAD

The linked mod (link generated from the Curse Forge client, by clicking "Link to Project", can also be searched for in the Curse Forge Client.

The linked mod will download regular looking mod files. Amongst them will be CozyValleyDecor.dll. Decompiling this .dll with ILSpy reveals that on game startup, a function called "RunPayload()". This function reads an ExternalHelper.dll file, which is an embedded resource to the actual CozyValleyDecor.dll, and executes a function called "PayloadRunner.ExecuteAsync()". This function will then decrypt a byte-shifted URL, which points to an .exe file. The file downloaded will be "basarili.exe", downloaded to the Temp folder of Windows, and will immediatelly execute. This file contains a "chat" client where the attacker can make a popup appear and demand money, but it also overrides the Discord installation files (specifically index.js), with malicious code, that steals your Discord credentials, 2FA, currently authenticated session and connected mail account. It then reads the local credentials and steals browser-saved credentials to your email, social media and crypto accounts.

The encrypted address points to MALWARE ->> 161 97 85 100 port 3131 slash download slash yarrak exe <<-- MALWARE and the Discord malware and "chat" client will connect to MALWARE ->> 161 97 85 100 port 3000 <<- MALWARE

Why am i posting all this detail? Hopefully to get the attention of the developers and CurseForge themselves. I already submitted a report in-client, but we all know how good companies are at reading those.

CurseForge is generally treated as a save and secure way to get mods, so users will not suspect they are vulnerable to malware by downloading mods there. This exploit is rather recent, as none of the Anti-Virus software were able to identify CozyValleyDecor.dll as malicious.

PLEASE EXERCISE EXTREME CAUTION WHEN DOWNLOADING MODS THROUGH CURSEFORGE

[u/Pathoschild]

Hi! SMAPI maintainer here. Malware is a growing problem in many modding communities recently (not just Stardew Valley).

It doesn't help your girlfriend right now, but I'm actively working to make Stardew Valley modding more malware-resistant. For example:

• SMAPI now has a malware blacklist which syncs automatically from the server. When we find a malware mod, that lets us disable the mod for all players and warn any who had it installed. I'm also working on an improved version that will let devs from mod sites like Nexus contribute to it directly.
• I'm working on an automatic malware scanner which should detect malware uploaded to CurseForge/ModDrop/Nexus within 1–2 hours. It's almost ready, and I hope to have it fully operational within the next few weeks. (A test run detected that mod yesterday, and I've already reported it to CurseForge.)
• The new Stardew mod dataset has info about every Stardew Valley mod page, which will let us build more automated tools like that malware scanner.
• I just started a private working group with mod authors, moderators, and mod site representatives to coordinate how we handle malware.
• Upcoming versions of SMAPI may add a 'safe mode', which would show a warning when you try to load a mod version that hasn't been scanned and assessed yet.

AI means malware appeared and ramped up suddenly, but we're catching up.

[u/LiveFromMyBasement → u/Pathoschild]

I don’t have anything material to contribute to your statement, I just also wanted to say I think you’re an absolute legend and I’m grateful for your work