coa

Timeline matches with the Travis breach. So far likely impacted: 1. Slack 2. Okta (https://news.ycombinator.com/item?id=34081154) 3. Coa (https://github.com/veged/coa/issues/99#issuecomment-96169688...)

It's been suggested a recent Travis CI breach was responsible. https://github.com/veged/coa/issues/99#issuecomment-96169688...

Correct: [0] -> Error: Cannot find module '/Users/me/.npm/_npx/27078/lib/node_modules/@svgr/cli/node_modules/coa/compile.js' What happened there was that he got the broken update, 2.0.3 which just referenced and used compile.js, but didn't include the file. Then 2.0.4 came out which included compile.js and compile.bat. Had he updated a couple of minutes later, this error would not have appeared. Not sure if /Users/ is a MacOS thing, but it is a Windows path structure, which might indicate that he was running this on Windows. And in that case he would have been compromised. [0] https://github.com/veged/coa/issues/99

For anyone interested, the malicious code can be found in the following link: https://github.com/veged/coa/issues/99#issuecomment-96153687... TLDR: The attacker injected an attack code as coa's `preinstall` script, which executes an obscurely-named file ("compile.bat"). This file is fully obfuscated, but what it does is basically to pull exploit DLLs from the attacker's server and install 'em. I think the fortunate part of this accident is that the attacker failed to deploy the malware in his/her first attempt; v2.0.3 only contained the half of the changeset that the exploit needs to work (which accidentally broke tons of CI builds); So some developers could notice that something is wrong a bit early.

That post doesn’t say much about `coa`, besides “new versions started appearing and builds started failing”. The bug report linked from GitHub advisory does a good job of describing the issue, though: https://github.com/veged/coa/issues/99