Open Source · · 1 day
rc npm releases carried malware
Attackers published rc 1.2.9, 1.3.9, and 2.3.9 with malicious postinstall code. The same account-takeover wave also hit coa.
rc was not only a downstream casualty of coa. npm and GitHub advisories identify three malicious rc releases: 1.2.9, 1.3.9, and 2.3.9. They appeared during the same November 2021 account-takeover wave that hit coa.
The injected install path ran obfuscated TypeScript, detected the operating system, and downloaded platform-specific shell or batch code. On Windows, reporting tied the chain to a DLL detected as Qakbot.
The release pattern was conspicuous. rc had not shipped a new release since December 2015, so a sudden new version in a package with more than ten million weekly downloads drew attention quickly. npm removed the affected versions.
GitHub's advisory treated any machine that installed or ran the affected versions as fully compromised and recommended downgrading to 1.2.8, rotating secrets from a separate system, and investigating for persistence.
Notes
- Forager and the current Diffend route did not recover the removed rc archives. A bounded report-derived behaviour fragment is retained under samples/ for 1.2.9, 1.3.9 and 2.3.9; it reconstructs neither the postinstall nor the payload.
Appendix · Affected releases
References
- Malware found in coa and rc, two npm packages with 23M weekly downloadstherecord.media
- Embedded malware in rcgithub.com
Source record: oss/attacks/rc/meta.yaml