{"id":102213,"date":"2021-11-05T03:36:51","date_gmt":"2021-11-05T01:36:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-npm-paket-coa-naschityvayushhij-9-mln-zagruzok-v-nedelyu-vnedreno-vredonosnoe-po"},"modified":"2021-11-05T03:36:51","modified_gmt":"2021-11-05T01:36:51","slug":"v-npm-paket-coa-naschityvayushhij-9-mln-zagruzok-v-nedelyu-vnedreno-vredonosnoe-po","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-npm-paket-coa-naschityvayushhij-9-mln-zagruzok-v-nedelyu-vnedreno-vredonosnoe-po","title":{"rendered":"The NPM package coa, which has 9 million downloads per week, has been compromised with malware.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Attackers managed to gain control over the NPM package coa and released updates 2.0.3, 2.0.4, 2.1.1, 2.1.3, and 3.1.3, which included malicious changes. The coa package, which provides functionality for parsing command-line arguments, has around 9 million downloads per week and is used as a dependency by 159 other NPM packages, including react-scripts and vue\/cli-service. The NPM administration has already removed the release with the malicious changes and blocked the publication of new versions until access to the main developer's repository is restored. <\/p>\n
The attack was carried out through the compromise of a developer account for the project. The added malicious changes are similar to those used in the attack two weeks ago on users of the NPM package UAParser.js, but were restricted to attacks solely on the Windows platform (with empty stubs left in the download blocks for Linux and macOS). An executable file was uploaded and executed from an external host to the user's system to perform Monero cryptocurrency mining (using the XMRig miner) and a library was installed to capture passwords. <\/p>\n
An error occurred during the formation of the package containing malicious code, which caused a failure during installation. As a result, the problem was quickly identified and the spread of the malicious update was blocked at an early stage. Users should ensure that they have version coa 2.0.2 installed and preferably add a binding in their projects' package.json to the working version in case of repeated compromise. npm and yarn: <resolutions>: { <coa>: <2.0.2> }, pnpm: <pnpm>: { <overrides>: { <coa>: <2.0.2> } } \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"