Compromised NPM packages of ua-parser-JS (0.7.29, 0.8.0, 1.0.0)

Re:Compromised NPM packages of ua-parser-JS (0.7.29, 0.8.0, ... by olex on Friday October 22, 2021 @05:50PM (#28963193)

Maintainer already released clean versions "on top of" the compromised ones, and NPM acted on reports and removed the compromised versions as well.

Compromised (and no longer downloadable from NPM):

- 0.7.29

- 0.8.0

- 1.0.0

Clean:

- 0.7.28 (last version before the hijack)

- 0.7.30

- 0.8.1

- 1.0.1

Compromised versions apparently contained a cryptomining tool capable of running on Linux, and a trojan that extracts sensitive data (saved passwords, cookies) from browsers on Windows. Both are blocked by up-to-date Windows Defender and presumably other AV software.

[ Parent | on HN ]

Re:Compromised NPM packages of ua-parser-JS (0.7.29, 0.8.0, ... by aleksandrh on Saturday October 23, 2021 @12:53PM (#28970173)

I have 0.7.28 as a dependency of a dependency and the miner is running on my system. So it may not just be 0.7.29?

[ Parent | on HN ]

Re:Compromised NPM packages of ua-parser-JS (0.7.29, 0.8.0, ... by aleksandrh on Saturday October 23, 2021 @04:24PM (#28971897)

User error, 0.7.28 is safe

[ Parent | on HN ]