Pierluigi Paganini November 05, 2021

Two popular npm libraries, coa and rc., have been hijacked, threat actors replaced them with versions laced with password-stealing malware.

The security team of the npm JavaScript package warns that two popular npm libraries, coa and rc., have been hijacked, threat actors replaced them versions laced with password-stealing malware.

Coa is a command-line argument parser with approximately 9 million weekly downloads, while Rc is a configuration loader with 4 million weekly downloads. Two npm libraries that have a total of 23 million weekly downloads, a data that is worrisome.

Experts warns that compromised coa versions are 2.0.3, 2.0.4, 2.1.1, 2.1.3, 3.0.1, 3.1.3, while compromised rc versions are 1.2.9, 1.3.9, 2.3.9.

The attackers gained access to the account of the developer of the package, then added a post-installation script to the original codebase, which runs an obfuscated TypeScript used to download a Windows batch or Linux bash script depending on the OS of the machine running the software.

TheRecord reported that the Windows batch script would download and run a DLL file containing a version of the Qakbot trojan.

The last stable coa version 2.0.2 was released in December 2018, but developers noticed that several suspicious versions (2.0.3, 2.0.4, 2.1.1, 2.1.3, and 3.1.3) were uploaded on the npm repository in a few hours, triggering errors on React packages that depend on ‘coa’.

The security team of the npm temporarily disabled the compromised account to investigate the incident.

Researchers from Bleeping Computer reported that the malware hidden in the tainted ‘coa’ versions is the same found in the hijacked ua-parser-js versions that were spotted last month. This circumstance suggests the presence of the same threat actor behind the two supply chain attacks.

The investigation allowed for the discovery of the compromise of the race package a few hours later.

The npm security team has removed all the compromised coa and rc versions of the packages.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, supply chain attack)

[adrotate banner=”5″]

[adrotate banner=”13″]

Both packages were compromised around the same time and were the result of attackers gaining access to a package developer’s account.