The recent wave of supply chain attacks targeting npm package repositories underscores critical security vulnerabilities in the open source ecosystem. Prominent npm packages such as <code>eslint-config-prettier</code>, <code>eslint-plugin-prettier</code>, and the utility package <code>is</code> have been compromised through sophisticated phishing campaigns.
Attackers employed typosquatted domains to deceive maintainers into revealing their npm credentials, subsequently injecting malware into widely-used packages. These attacks involved dual malware variants, one being a Windows-specific DLL, dubbed ‘Scavenger’, which harvested browser data, and the other a cross-platform JavaScript loader granting remote command and control capabilities.
In separate incidents, Toptal’s GitHub account was compromised, leading to the distribution of malware through their npm developer toolbox packages, affecting around 5,000 downloads before rectification. This malware was designed to exfiltrate GitHub authentication tokens and persistently establish backdoor access.
The infected packages, with millions of weekly downloads, demonstrated the cascading impact such compromises can have across thousands of projects. Responding swiftly, maintainers have reset credentials, deprecated harmful package versions, and worked with the npm registry to remove infected packages.
These incidents not only spotlight the vulnerability of developer account security but also the expansive reach malware can achieve through trusted repositories and automated publishing workflows. They highlight the pressing need for enhanced security measures, such as Google’s OSS rebuild initiative and automated tools like JFrog Curation, to detect and block malicious packages before infiltration into development environments.
As the landscape of open source software continues to grow, it becomes increasingly imperative to fortify package supply chains against cybercriminal strategies aimed at weaponizing maintainer accounts to spread malicious code.

Collections

Recent supply chain attacks compromised popular npm packages including eslint-config-prettier and eslint-plugin-prettier through sophisticated phishing campaigns using typosquatted domains. Attackers harvested maintainer credentials to inject malware variants, including a Windows DLL called 'Scavenger' for data theft and cross-platform JavaScript loaders for remote control. The attacks affected millions of weekly downloads and thousands of projects, prompting swift responses from maintainers and highlighting the urgent need for enhanced security measures in open source package repositories.

Supply Chain Attack Targeting ESLint Prettier Plugin Maintainers