Executive brief
The coa npm package, a command-line argument parsing library with millions of weekly downloads, was compromised with malicious code that runs automatically when installed. Any system with affected versions (2.0.3 and above) should be considered fully compromised; all secrets and credentials must be rotated immediately from a different machine, as the malware grants outside entities complete control of the system.
Technical details
The npm package coa was compromised through unauthorized package maintainer access, with malicious code embedded in the package.json preinstall script (executing "start /B node compile.js" on Windows). The attack runs automatically during package installation without user interaction, granting remote attackers full system compromise. Affected versions include 2.0.3, 2.0.4, 2.1.1, 2.1.3, 3.0.1, and 3.1.3. The malicious versions were published briefly (November 4, 2021, 14:12–15:24 CET) before npm removed them; affected systems should downgrade to version 2.0.2 and assume complete system compromise requiring full remediation beyond simple package removal.
Affected products
- <unknown> coa 2.0.3, 2.0.4, 2.1.1, 2.1.3, 3.0.1, 3.1.3
Timeline
- 2021-11-04: disclosed: Malicious versions published to npm
- 2021-11-04: other: Malicious versions removed from npm after ~70 minutes