rc npm releases carried malware

rc was not only a downstream casualty of coa. npm and GitHub advisories identify three malicious rc releases: 1.2.9, 1.3.9, and 2.3.9. They appeared during the same November 2021 account-takeover wave that hit coa.

The injected install path ran obfuscated TypeScript, detected the operating system, and downloaded platform-specific shell or batch code. On Windows, reporting tied the chain to a DLL detected as Qakbot.

The release pattern was conspicuous. rc had not shipped a new release since December 2015, so a sudden new version in a package with more than ten million weekly downloads drew attention quickly. npm removed the affected versions.

GitHub's advisory treated any machine that installed or ran the affected versions as fully compromised and recommended downgrading to 1.2.8, rotating secrets from a separate system, and investigating for persistence.

Motive

Credential Theft

Cause

Compromised Account Credentials

Transitive

Yes

User Impact

10000000

• Malware found in coa and rc, two npm packages with 23M weekly downloadstherecord.media
• Malicious code found in npm package rc and coasnyk.io
• Embedded malware in rcgithub.com