← Supply-Chain Attack Compendium

mailparser

Incident Summary

mailparser NPM package compromised downloads executes binary

The maintainer's npm account for mailparser was compromised, and malicious version 0.1.2 was published to the registry. Its install path attempted to download and execute an OS-specific binary from an external server, but the package was removed within an hour and saw fewer than 100 downloads.

Date
2019-03-12
Category
Open Source
Target Surface
Package registry
Insertion Phase
distribution
Impact
Backdoor
Cause
Compromised Account/Credentials

What Was Affected

Package mailparser
LanguageJavascript
ComponentLibrary
Artifact typesource archive
Domain typepackage host
Domain npmjs.org

Compromised Versions

Incident Context

Motive
Unauthorized Access/Control
Attribution
Individual Hacker
Transitive
No
User Impact
100
Observed Duration
0 days

Evidence

Compromised Artifacts

Current Artifacts and Analysis

Indicators and Changes

Hashes

  • sha256:a7c55ef358ba3b90def7f46fd0ad40830e0df3b6f68e32cdb8603c4ccb0cc45a

External References

Source Data

Source record: oss/mailparser/meta.yaml