From securityaffairs.co
The security team of the npm JavaScript package warns that two popular npm libraries, coa and rc., have been hijacked, threat actors replaced them versions laced with password-stealing malware.
Coa is a command-line argument parser with approximately 9 million weekly downloads, while Rc is a configuration loader with 4 million weekly downloads. Two npm libraries that have a total of 23 million weekly downloads, a data that is worrisome.
Experts warns that compromised coa versions are 2.0.3, 2.0.4, 2.1.1, 2.1.3, 3.0.1, 3.1.3, while compromised rc versions are 1.2.9, 1.3.9, 2.3.9.
The attackers gained access to the account of the developer of the package, then added a post-installation script to the original codebase, which runs an obfuscated TypeScript used to download a Windows batch or Linux bash script depending on the OS of the machine running the software.