Malicious javascript compromise on npmjs.com
These packages, about a billion downloads prior
supports-hyperlinks
chalk-template
simple-swizzle
slice-ansi
error-ex
is-arrayish
wrap-ansi
backslash
color-string
color-convert
color
color-name
Thread follows.
A bunch of packages published by qix in NPM just got backdoored it looks like. Obfuscated code was added like two hours ago. #threatintel #npm
If you want an idea of scale of trojan attempt - 'color' alone had 32m downloads in a week, the combined attempt was pushing a billion due to upstream dependencies.
Hunt tip: look for registry.npmjs.org in proxy logs, package names are in the URLs.
additional backdoored packages
ansi-styles
debug
chalk
supports-color
strip-ansi
ansi-regex
has-ansi
@GossiTheDog Do you have a list of the compromised versions?
A few of these, when I check I see that the version published this morning is still present and the latest version. But a quick glance at the code and I don't see the compromise; I'm just doing a quick scan, but some of these packages are so simple that there's really not many places you could hide it:
https://www.npmjs.com/package/has-ansi?activeTab=code
I'm just trying to compile a list of compromised versions so I can do a quick scan of our systems, but for some of these I haven't been able to find an exploited version.
Maybe the attackers script failed to insert the exploit, as we do see a number of these packages all updated at the same time, but I don't see the exploit code in them. Packages fitting that pattern:
* color
* supports-color
* strip-ansi
* ansi-regex
* has-ansi
(note: all of this is based on a quick glance using the code tab on the NPM registry; it's possible that I could have missed the right file, or missed it when scanning visually, or the code tab might not be showing the version it claims, or the like)
@GossiTheDog Here's my best attempt at a list of the bad versions:
- supports-hyperlinks 4.1.1
- chalk-template 1.1.1
- simple-swizzle 0.2.3
- slice-ansi 7.1.1
- error-ex 1.3.3
- is-arrayish 0.3.3
- wrap-ansi 9.0.1
- backslash 0.2.1
- color-string 2.1.1
- color-convert 3.1.1
- color 5.0.1
- color-name 2.0.1
- ansi-styles 6.2.2
- debug 4.4.2
- chalk 5.6.1
- supports-color 10.2.1
- strip-ansi 7.1.1
- ansi-regex 6.2.1
- has-ansi 6.0.1
Edit: updated with confirmed versions from author who was pwned: https://news.ycombinator.com/item?id=45169794
@GossiTheDog Also, holy hell the left-pad nature of some of these deps. Here's the entire source of has-ansi:
import ansiRegex from 'ansi-regex';
const regex = ansiRegex({onlyFirst: true});
export default function hasAnsi(string) {
return regex.test(string);
}
Kevin Beaumont
Brian Campbell