Malicious javascript compromise on npmjs.com
These packages, about a billion downloads prior
supports-hyperlinks
chalk-template
simple-swizzle
slice-ansi
error-ex
is-arrayish
wrap-ansi
backslash
color-string
color-convert
color
color-name
Thread follows.
A bunch of packages published by qix in NPM just got backdoored it looks like. Obfuscated code was added like two hours ago. #threatintel #npm
If you want an idea of scale of trojan attempt - 'color' alone had 32m downloads in a week, the combined attempt was pushing a billion due to upstream dependencies.
Hunt tip: look for registry.npmjs.org in proxy logs, package names are in the URLs.
additional backdoored packages
ansi-styles
debug
chalk
supports-color
strip-ansi
ansi-regex
has-ansi
Weekly download stats for impacted packages prior to incident
ansi-styles (371.41m)
debug (357.6m)
backslash (0.26m)
chalk-template (3.9m)
supports-hyperlinks (19.2m)
has-ansi (12.1m)
simple-swizzle (26.26m)
color-string (27.48m)
error-ex (47.17m)
color-name (191.71m)
is-arrayish (73.8m)
slice-ansi (59.8m)
color-convert (193.5m)
wrap-ansi (197.99m)
ansi-regex (243.64m)
supports-color (287.1m)
strip-ansi (261.17m)
chalk (299.99m)
Total 2674m
@leoluk @GossiTheDog Draconian systems that limit who can write and publish code are NOT the solution here.
The solution is not having LPMs (language package managers) that pull code from unvetted package repositories in an automated manner, and languages that encourage using thousands of random garbage microdependencies rather than well-vetted, versioned libraries.
@joby @leoluk @GossiTheDog Or even just copy&paste the 9 lines of code you needed!
It's about the same amount of code as the interface surface declaring the dependency you needed and binding to it - but without introducing any new interface surface or trust surface!
External dependencies that are not c&p into your own code make sense for something large and complex that's likely subject to bugs/fixes, changing requirements of third-party things they interface with, etc. Not for trivial stuff that's a couple lines of js.
@dalias @joby @leoluk @GossiTheDog
Indeed. I've been openly criticizing language built-in package managers for over a decade now. Having them encourages sloppy coding and short circuits developers' brains not to apply due diligence.
NPM, Pip, Cargo… IMHO those are inherently problematic. My personal motto in software development is: Find the dependencies and eliminate them!
Kevin Beaumont
Leo@ALLES
Cassandrich
Joby 
(he/him)
datenwolf