Full Report
Popular JavaScript libraries eslint-config-prettier and eslint-plugin-prettier were hijacked this week and turned into malware droppers, in a supply chain attack achieved via targeted phishing and credential theft. [...]
Analysis Summary
# Incident Report: Hijacking of Popular npm Linter Packages
## Executive Summary
A supply chain incident occurred where popular npm linter packages were compromised through a phishing attack targeting the maintainer, resulting in the injection of malware into the published versions. The primary impact is the potential compromise of developers using these packages, especially on Windows systems, due to the execution of malicious code. Response actions involved marking the compromised versions as deprecated on the npmjs registry and advising users to check other packages from the same maintainer.
## Incident Details
- **Discovery Date:** Not explicitly stated, but response actions indicate recent discovery.
- **Incident Date:** Not explicitly stated, presumed recent relative to the reporting date.
- **Affected Organization:** Maintainers/Publishers of popular npm linter packages (Supply Chain).
- **Sector:** Software Development / Open Source Ecosystem.
- **Geography:** Global impact across the developer community using npm.
## Timeline of Events
### Initial Access
- **Date/Time:** Not specified.
- **Vector:** Phishing attack targeting the package maintainer.
- **Details:** The attacker successfully compromised the maintainer, likely through credential theft via phishing, enabling them to upload malicious code into the package.
### Lateral Movement
- This phase appears to be focused on code injection into the published package rather than network lateral movement within an internal corporate network. The attack leveraged the trust inherent in the software supply chain.
### Data Exfiltration/Impact
- **Details:** The compromised packages dropped malware, which showed signs of compromise, especially on Windows machines. The exact nature of the malware (e.g., info-stealer, RAT) is implied but not fully detailed for the core incident, though related incidents mentioned info-stealing.
### Detection & Response
- **How it was discovered:** Not explicitly stated, but signs of compromise were observed, particularly on Windows machines.
- **Response actions taken:** The maintainer marked the compromised versions as "deprecated" on the npmjs registry. Users were alerted to check other packages from the same maintainer for tampering.
## Attack Methodology
- **Initial Access:** Phishing leading to account takeover of the npm package maintainer.
- **Persistence:** Likely established through the malicious code embedded within the published package versions.
- **Privilege Escalation:** Not explicitly detailed, but successful injection into published packages suggests elevated access to the publishing mechanism.
- **Defense Evasion:** The malware was likely designed to execute upon installation/use of the package, bypassing standard build environment security if executed during the build process.
- **Credential Access:** Implied through the initial phishing success against the maintainer.
- **Discovery:** Not detailed.
- **Lateral Movement:** Not the primary focus; the compromise was focused on downstream consumers.
- **Collection:** Malicious code was designed to collect data or establish a foothold (implied by "signs of compromise").
- **Exfiltration:** Not detailed beyond the placement of malware.
- **Impact:** Installation and execution of malware on developer systems using the affected packages.
## Impact Assessment
- **Financial:** Unspecified, but developer time lost investigating and cleaning systems.
- **Data Breach:** Potential compromise of developer credentials or project data executed on systems where affected packages were installed/built.
- **Operational:** Disruption to development workflows reliant on these linter packages.
- **Reputational:** Further damage to trust in the open-source supply chain ecosystem (npm).
## Indicators of Compromise
- **Network indicators:** None provided (defanged).
- **File indicators:** Malware payload dropped on affected systems (especially Windows).
- **Behavioral indicators:** Execution of malicious code upon installation or use of the affected package versions.
## Response Actions
- **Containment measures:** Marking compromised package versions as "deprecated" on npmjs.
- **Eradication steps:** Users must remove the compromised versions and scan local environments thoroughly.
- **Recovery actions:** Developers using affected packages should rotate any secrets that may have been exposed during the build processes utilizing the compromised libraries.
## Lessons Learned
- The extreme fragility of the open-source supply chain, where the compromise of a single maintainer account via phishing can put millions of downstream users at risk.
- The critical importance of robust multi-factor authentication and phishing awareness training for maintainers of widely used packages.
- The necessity for consumers to verify not just direct dependencies but also to trust packages from compromised maintainers cautiously.
## Recommendations
- Implement mandatory hardware-based MFA for all package maintainers on critical registries like npm.
- Developers should strictly vet dependencies and consider using lock files to pin versions, coupled with automated dependency scanning (SCA).
- Organizations should assume trust boundaries might be breached in the supply chain and isolate/vet dependencies used during build processes, especially those running on developer workstations.
- Consumers should actively check advisories for deprecated versions related to popular packages.