Two NPM Packages With 22 Million Weekly Downloads Found Backdoored

In what’s yet another instance of supply chain attack targeting
open-source software repositories, two popular NPM packages with
cumulative weekly downloads of nearly 22 million were found to be
compromised with malicious code by gaining unauthorized access to
the respective developer’s accounts.

The two libraries in question are “coa^[1],” a parser for
command-line options, and “rc,” a configuration loader, both of which were
tampered^[2]
by an unidentified threat actor^[3] to include “identical”
password-stealing malware.

All versions of coa starting with 2.0.3 and above — 2.0.3,
2.0.4, 2.1.1, 2.1.3, 3.0.1, and 3.1.3 — are impacted, and users of
the affected versions are advised to downgrade to 2.0.2 as soon as
possible and check their systems for suspicious activity, according
to a GitHub advisory published^[4]
on November 4. In a similar vein, versions 1.2.9, 1.3.9, and 2.3.9
of rc have been found laced with malware, with an independent alert^[5]
urging users to downgrade to version 1.2.8.

Additional analysis of the dropped malware samples^[6]
show it be a DanaBot variant which is a Windows malware for
stealing credentials and passwords, echoing two similar incidents
from last month that resulted in the compromise of UAParser.js^[7]
as well as the publishing of rogue, typosquatted Roblox NPM
libraries^[8].

“To protect your accounts and packages from similar attacks, we
highly recommend enabling [two-factor
authentication]^[9]
on your NPM account,” NPM said^[10] in a tweet.