Executive brief
The popular JavaScript library 'ua-parser-js', used to identify browser and device information, was compromised by an unauthorized party who inserted malicious code into three specific versions. Any system that installed these versions should be considered fully compromised, potentially allowing attackers to steal sensitive credentials, keys, and data. Organizations using this library must immediately upgrade to a clean version and rotate all secrets stored on affected machines.
Technical details
The npm package 'ua-parser-js' suffered a supply chain attack where versions 0.7.29, 0.8.0, and 1.0.0 were published containing malicious code (CWE-506). The malware is designed to execute upon installation or runtime, potentially granting attackers full control over the host environment. This allows for the exfiltration of environment variables, secrets, and authentication keys. The vulnerability is triggered via a network-based delivery of the malicious package, though it requires the user to perform an installation or update (User Interaction). Patched versions 0.7.30, 0.8.1, and 1.0.1 have been released to remediate the issue.
Affected products
- faisalman ua-parser-js 0.7.29, 0.8.0, 1.0.0
Timeline
- 2021-10-22: disclosed
- 2021-10-22: advisory
- 2021-10-22: patched