https://www.truesec.com/hub/blog/uaparser-js-npm-package-supply-chain-attack-impact-and-response * How We Help Cybersecurity challenges + Identify Your Vulnerabilities and Risks + Develop and Manage Your IT Securely + Detect and Respond to Intrusion + Respond to and Quickly Overcome a Cyber Attack + Get Cybersecurity Advice + How We Help Essential cybersecurity capabilities + o Predict o Prevent o Detect o Respond o Recover + Our Services + Are you under attack? Don't lose valuable time - act now! * Why Truesec + Why Truesec + Who We Are + Cases + Our Experts + Career * Knowledge Hub + Knowledge & Resources + Events + Tech Talks + Trainings + Blog + News * Under attack? * Get in touch * How We Help Cybersecurity challenges + Identify Your Vulnerabilities and Risks + Develop and Manage Your IT Securely + Detect and Respond to Intrusion + Respond to and Quickly Overcome a Cyber Attack + Get Cybersecurity Advice + How We Help Essential cybersecurity capabilities + o Predict o Prevent o Detect o Respond o Recover + Our Services + Are you under attack? Don't lose valuable time - act now! * Why Truesec + Why Truesec + Who We Are + Cases + Our Experts + Career * Knowledge Hub + Knowledge & Resources + Events + Tech Talks + Trainings + Blog + News * Under attack? * Get in touch Featured image Truesec pattern Blog 2021-10-24 A Truesec investigation UAParser.js npm Package Supply Chain Attack: Impact and Response UAParser.js, a popular project with 7 million downloads weekly, was hijacked to deliver malware in a supply chain attack. This article describes the key elements of the attack, and how to determine if you were affected. Sebastian Olsson 4 min readSebastian Olsson Truesec pattern Featured image Share Note: This is a developing story. What Has Happened? Malware was added to a very popular project on npm called ua-parser-js (> 7 million weekly downloads). Three malicious versions were published. Those were later superseded by benign versions and finally unpublished. The project is used directly or indirectly by many web projects. Most users are likely not even aware of using it. Developers that have downloaded or installed npm packages during the time period may have received the malware. Figuring out if that has happened can be tricky. Other changes to the dependency tree or clean installs could have triggered the malicious package. At the very least, check package caches on developer machines for malicious versions and check for running malware. The most dangerous time-period seems to have been Friday 22 between ~12:15 and 16:27 UTC when the malware was tagged as the latest versions. It was available for explicit download a while after before being unpublished. Why Is This a Notable Problem? Malware embedded into package managers can endanger many parts of an environment. It can typically execute and affect the developer machine, the build environment (CI/CD) and likely even the production environment. A modern developer computer or CI/CD environment has access to many keys and secrets related to sensitive systems and can of course be used to leverage further attacks on customers as well. The project is very common in modern web projects. It is a direct dependency of common packages such as "fbjs" and "karma". At the time of writing ua-parser-js has 5.9k stars and 949 forks on GitHub. It is listed as having 1,215 direct (public) dependents on npmjs.com, and can be expected to have many times as many indirect public and private dependents (deps.dev lists 53 208 publicly known indirect dependencies). Since the malware likely steals credentials, the secondary effects may not be visible for a long time. Make sure to reimage machines and rotate secrets if affected. Who Was Affected? Broadly speaking anyone that match the following could have gotten the malware. If: * You added the malicious versions to your package.json or otherwise installed the package (0.7.29, 0.8.0, 1.0.0). * Had a direct or indirect dependency on the package in question, without explicitly locking down versions. For example, a dependency on the package with version set as "^0.7.28" This can affect both developer machines and CI/CD environments! Recommendations with regards to rotating secrets and reinstalling will typically extend to servers using this package as well. What are some mitigating factors? * Not running npm/yarn install while the malicious package was available. * Only running with frozen/locked dependencies. Note however that if you added some other package during the timeframe that might have led to the dependencies being reevaluated. * If "ignore-scripts" or similar was set to true * MacOs was likely unaffected How Do I Know if I Was Affected? As this is a developing story, it is hard to say what all indicators are. Truesec's Fabio Viggiani has posted notes on indicators of compromise and malware behavior on Twitter, and several other teams are working on incidents as well as analysis of the malware. If you are running Windows with AV enabled it is likely that Defender and others have noted the malware. Beyond looking for indicators of the malware running on systems, we can also look for the package on the machine: * Look for the versions 0.7.29, 0.8.0 and 1.0.0 of ua-parser-js in node_modules or other cache directories * Look for the malicious versions in any package-lock.json, yarn.lock or similar package lock files. * If a central dependency repository/cache such as Nexus or Artifactory is used: See if the malicious versions have been proxied/cached by any user. It is not sufficient to only look for the versions in lockfiles as those could have been reevaluated on developer machines, ci/cd or pr branches without being pushed to main. Don't forget to check CI/CD. Pull requests for other package updates could have triggered the malware. How Could This Happen? Somehow the threat actor got access to the publishers keys/identity and managed to publish malicious versions. It has not been publicly stated how the threat actor got access to the publisher's identity. How Can We Avoid This in the Future? The npm ecosystem is not well. Composability is admirable, but we can't trust hundreds of publishers. Locking versions, having vulnerability feeds and leveraging quarantine can mitigate. We can propose MFA for publishers all we want, we still can't trust that many. I elaborate a bit on this is my blog post about supply chain threats and mitigations: https://www.truesec.com/hub/blog/ secure-your-software-supply-chain-threats-and-mitigations . Why Three Versions? The project didn't have a 0.8 or 1.0 track previously, but the TA still pushed 0.8.0 and 1.0.0. This increased the reach, as those versions would be the latest minor and major versions (similar to how using later version works for dependency confusion (https:// medium.com/@alex.birsan/dependency-confusion-4a5d60fec610) More Keep up to date with the GitHub advisory (https://github.com/ advisories/GHSA-pjwm-rvh2-c87w) and ua-parser-js issue (https:// github.com/faisalman/ua-parser-js/issues/536). CybersecuritySupply Chain Stay ahead in cyber Join 1000+ other cyber professionals and get our regular updates with cyber knowledge and technical know-how. You might also like... Go to Knowledge Hub Managing Threats and Vulnerabilities from 3rd Party Dependencies Tech Talk Managing Threats and Vulnerabilities from 3rd Party Dependencies [sebastian-] Sebastian Olsson [Johan-Lind] Johan Lindfors Security Therapy for Software Teams Tech Talk Security Therapy for Software Teams [sebastian-] Sebastian Olsson [richard_ul] Richard Ulfvin Avoid Supply-chain Attacks Similar to SolarWinds Orion Blog 2021-01-06 Avoid Supply-chain Attacks Similar to SolarWinds Orion [sebastian-] Sebastian Olsson Secure Development23 min read The Ruthless World of Cybercrime Blog 2020-05-01 The Ruthless World of Cybercrime [fabio-vigg] Fabio Viggiani 3 min read Kaseya Supply-Chain Attack Targeting MSPs to Deliver REvil Ransomware Blog 2021-10-07 Kaseya Supply-Chain Attack Targeting MSPs to Deliver REvil Ransomware [fabio-vigg] Fabio Viggiani 7 min read Guide A CISO's Guide to Incident Readiness Cybersecurity1 min min read Article Time to Battle-Test Your Company's IT Defense Cybersecurity3 min read Blog When the Cyberthreat Comes From the Inside [carolina-a] Carolina Angelis Cybersecurity4 min read Why Safeguarding Your Digital Assets Is a Must Article 2021-08-31 Why Safeguarding Your Digital Assets Is a Must Cybersecurity2 min read HiveNightmare a.k.a. SeriousSam Local Privilege Escalation in Windows - CVE-2021-36934 Blog 2021-07-20 HiveNightmare a.k.a. SeriousSam Local Privilege Escalation in Windows - CVE-2021-36934 [hasain-als] Hasain Alshakarti Cybersecurity2 min read How We Help * Identify Your Vulnerabilities and Risks * Develop and Manage Your IT Securely * Detect and Respond to Intrusion * Respond to and Quickly Overcome a Cyber Attack * Get Cybersecurity Advice * Our Services Why Truesec * Who We Are * Career * Our Experts * Swedish Newsroom * Business Policy Knowledge Hub * Knowledge & Resources * Events * Tech Talks * Trainings * Blog * News Contact Sweden +46 8 10 00 10 hello@truesec.se Headquarters Stockholm Oxtorgsgrand 2, 5 tr 111 57 Stockholm Malmo Torggatan 4, 7 tr 211 40 Malmo Karlskrona Drottninggatan 54, 2 tr 371 33 Karlskrona US +1 (425) 818-8044 info@truesec.com Follow us * Facebook * Twitter * LinkedIn * * Privacy Policies & Terms (c) Truesec