Open Source · · 1 day

rc npm releases carried malware

Attackers published rc 1.2.9, 1.3.9, and 2.3.9 with malicious postinstall code. The same account-takeover wave also hit coa.

rc was not only a downstream casualty of coa. npm and GitHub advisories identify three malicious rc releases: 1.2.9, 1.3.9, and 2.3.9. They appeared during the same November 2021 account-takeover wave that hit coa.

The injected install path ran obfuscated TypeScript, detected the operating system, and downloaded platform-specific shell or batch code. On Windows, reporting tied the chain to a DLL detected as Qakbot.

The release pattern was conspicuous. rc had not shipped a new release since December 2015, so a sudden new version in a package with more than ten million weekly downloads drew attention quickly. npm removed the affected versions.

GitHub's advisory treated any machine that installed or ran the affected versions as fully compromised and recommended downgrading to 1.2.8, rotating secrets from a separate system, and investigating for persistence.

Appendix · Affected releases

References

  1. Malware found in coa and rc, two npm packages with 23M weekly downloadstherecord.media
  2. Embedded malware in rcgithub.com

Source record: oss/attacks/rc/meta.yaml