Attackers managed to gain control over the NPM package coa and released updates 2.0.3, 2.0.4, 2.1.1, 2.1.3, and 3.1.3, which included malicious changes. The coa package, which provides functionality for parsing command-line arguments, has around 9 million downloads per week and is used as a dependency by 159 other NPM packages, including react-scripts and vue/cli-service. The NPM administration has already removed the release with the malicious changes and blocked the publication of new versions until access to the main developer's repository is restored.
The attack was carried out through the compromise of a developer account for the project. The added malicious changes are similar to those used in the attack two weeks ago on users of the NPM package UAParser.js, but were restricted to attacks solely on the Windows platform (with empty stubs left in the download blocks for Linux and macOS). An executable file was uploaded and executed from an external host to the user's system to perform Monero cryptocurrency mining (using the XMRig miner) and a library was installed to capture passwords.
An error occurred during the formation of the package with malicious code, which caused installation failures, allowing the problem to be quickly identified and the spread of the malicious update to be blocked at an early stage. Users should ensure they have version coa 2.0.2 installed and preferably add a binding to the working version in their project's package.json in case of re-compromise. npm and yarn: "resolutions": { "coa": "2.0.2" }, pnpm: "pnpm": { "overrides": { "coa": "2.0.2" } },
Source: opennet.ru
