coa and rc npm Packages Compromised: What Happened
Days after the ua-parser-js compromise, two more widely used npm packages were hijacked using a near-identical method. coa, a command-line argument parser with roughly 8.8 million weekly downloads, and rc, a configuration file loader with roughly 14.2 million weekly downloads, both had their maintainer accounts compromised in early November 2021. The attacker published new versions carrying a password-stealing payload almost identical to the one used against ua-parser-js days earlier, strongly suggesting the same actor or toolkit.
What happened
In both cases, the attacker gained access to a maintainer's npm publishing credentials and added a post-installation script to the package. That script ran an obfuscated piece of TypeScript which checked the host operating system and then downloaded either a Windows batch script or a Linux bash script designed to harvest passwords and other credentials from the infected machine.
npm's security team removed the compromised versions once identified: for coa, versions 2.0.3, 2.0.4, 2.1.1, 2.1.3, 3.0.1, and 3.1.3; for rc, versions 1.2.9, 1.3.9, and 2.3.9. npm publicly attributed the incident to compromised maintainer accounts and recommended two-factor authentication as the primary defense, echoing the same root cause identified in the eslint-scope and ua-parser-js incidents.
Packages affected
- coa versions 2.0.3, 2.0.4, 2.1.1, 2.1.3, 3.0.1, 3.1.3 (compromised)
- rc versions 1.2.9, 1.3.9, 2.3.9 (compromised)
How 0Day mitigates this
Read how continuous matching differs from checking advisories after the fact, or see the exact, read-only access 0Day needs to do this for an organization.
Sources
The Record: Malware Found in coa and rc
Rapid7: New NPM Library Hijacks (coa and rc)
BleepingComputer: Popular coa NPM Library Hijacked to Steal User Passwords