ua-parser-js npm Package Compromised: What Happened
On October 22, 2021, the npm account of the maintainer of ua-parser-js, a library used to detect browser, OS, and device type from User-Agent strings with nearly 8 million weekly downloads, was hijacked. The attacker published three malicious versions, 0.7.29, 0.8.0, and 1.0.0, containing a script that installed a cryptocurrency miner and harvested credentials on both Windows and Linux machines. The malicious versions were live for roughly four hours before the maintainer regained control and pulled them.
What happened
ua-parser-js sat deep in the dependency tree of an unusually large number of projects, including tools used internally at companies like Facebook, which is what made a short compromise window still notable. The maintainer, Faisal Salman, stated afterward that someone had hijacked his npm account and published the compromised packages without his knowledge. The malicious versions were available for download starting at approximately 12:15 PM GMT and were pulled between 4:16 and 4:26 PM GMT the same day.
Because the community reported the issue quickly and the maintainer responded fast, exposure was largely limited to teams that happened to run an install or a CI build during that specific four-hour window. Anyone affected was advised to upgrade immediately to the next clean versions, 0.7.30, 0.8.1, or 1.0.1, and to check their systems for signs of the coinminer or credential-harvesting payload.
Packages affected
- ua-parser-js versions 0.7.29, 0.8.0, and 1.0.0 (compromised)
- Clean versions: 0.7.30, 0.8.1, 1.0.1
How 0Day mitigates this
See how this differs from a dependency scanner that only checks known advisories, or read the exact access 0Day needs to watch for this.
Sources
CISA: Malware Discovered in Popular NPM Package, ua-parser-js
Rapid7: NPM Library ua-parser-js Hijacked
Truesec: The Supply Chain Attack of UAParser.js