Тут опять NPM поломали

*Starting at September 8th, 13:16 UTC, our Aikido intel feed alerted us to a series packages being pushed to npm, which appeared to contains malicious code. These were 18 very popular packages,

backslash (0.26m downloads per week) chalk-template (3.9m downloads per week) supports-hyperlinks (19.2m downloads per week) has-ansi (12.1m downloads per week) simple-swizzle (26.26m downloads per week) color-string (27.48m downloads per week) error-ex (47.17m downloads per week) color-name (191.71m downloads per week) is-arrayish (73.8m downloads per week) slice-ansi (59.8m downloads per week) color-convert (193.5m downloads per week) wrap-ansi (197.99m downloads per week) ansi-regex (243.64m downloads per week) supports-color (287.1m downloads per week) strip-ansi (261.17m downloads per week) chalk (299.99m downloads per week) debug (357.6m downloads per week) ansi-styles (371.41m downloads per week)

All together, these packages have more than 2 billion downloads per week.* npm debug and chalk packages compromised https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised

Был подсунут обфусцированный код, который перехватывал трафик

This malware is essentially a browser-based interceptor that hijacks both network traffic and application APIs. It injects itself into functions like fetch, XMLHttpRequest, and common wallet interfaces, then silently rewrites values in requests and responses.

Украли доступ через фишинг у одного мантейнера https://bsky.app/profile/bad-at-computer.bsky.social/post/3lydje4zqis2y

В статье утверждается, что похожей атаке подвергся и мантейнер других пакетов

Таблицу с версиями пакетов прикрепил к посту

Дополнительные ссылки почитать

We Just Found Malicious Code in the Popular NPM Package https://jdstaerk.substack.com/p/we-just-found-malicious-code-in-the

https://news.ycombinator.com/item?id=45169657

npm Author Qix Compromised via Phishing Email in Major Supply Chain Attack https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack

Issue https://github.com/chalk/chalk/issues/656 https://github.com/debug-js/debug/issues/1005#issuecomment-3266885191

Что бы проверить нет ли в ваших зависимостях гадости

$ rg -uu --max-columns=80 --glob '*.js' _0x112fa8

Тут опять NPM поломали *Starting at September 8th, 13:16 UTC, our Aikido intel feed alerted us to a series packages being pushed to npm, which appeared to contains malicious code | Сетка — социальная сеть от hh.ru Тут опять NPM поломали *Starting at September 8th, 13:16 UTC, our Aikido intel feed alerted us to a series packages being pushed to npm, which appeared to contains malicious code | Сетка — социальная сеть от hh.ru