eslint-scope npm Account Hijack: What Happened
On July 12, 2018, an attacker compromised the npm account of an ESLint maintainer and published malicious versions of two packages, eslint-scope and eslint-config-eslint. On install, the malicious code silently downloaded and executed a script from pastebin.com that read the contents of the victim's .npmrc file, the configuration file that typically stores npm publish authentication tokens, and sent it to the attacker. It is one of the earliest widely documented cases of an npm maintainer account takeover being used specifically to harvest credentials for further supply chain compromise.
What happened
eslint-scope is a dependency of ESLint, one of the most widely used JavaScript linters, which meant the malicious version reached a large number of downstream projects quickly. The attacker published eslint-scope@3.7.2 and eslint-config-eslint@5.0.2, both since unpublished. The payload's goal was not to damage the victim's machine directly, but to harvest npm access tokens that could then be used to compromise further packages, exactly the kind of credential-theft-as-a-stepping-stone pattern that has recurred in nearly every major npm incident since.
npm's response was to revoke all access tokens issued before July 12, 2018 at 12:30 UTC, a blanket mitigation that neutralized any tokens the attacker might have harvested, valid or not. The postmortem published by the ESLint team noted that the compromised maintainer had reused their npm password across multiple sites and did not have two-factor authentication enabled, a root cause that has repeated across many subsequent npm account takeovers.
How 0Day mitigates this
See how this differs from waiting on a dependency scanner, or read the exact, read-only access 0Day needs to do this for an organization.
Sources
ESLint: Postmortem for Malicious Package Publishes
npm Blog: Community Questions Following the ESLint Security Incident
The Register: NPM Package Dev Logins Slurped by Hacked Tool