Executive brief
A malicious version of the eslint-config-eslint npm package was published without authorization. The compromised version automatically steals npm authentication tokens from developers' .npmrc configuration files and sends them to a remote attacker-controlled server. Any developer who installed this package had their npm credentials exposed, enabling account takeover and potential unauthorized access to private packages.
Technical details
This is a supply chain attack involving unauthorized publication of a malicious package version. The attacker published version 5.0.2 of eslint-config-eslint to npm with injected code that reads the user's .npmrc file (which contains npm authentication tokens) and exfiltrates them to an attacker-controlled remote server. The attack requires only that the package be installed via npm; the malicious code executes during installation or package initialization. All users who installed version 5.0.2 had their npm credentials compromised, enabling the attacker to access private packages, publish further malicious packages, or modify existing packages. Mitigation requires revoking all npm authentication tokens and downgrading to version 5.0.1.
Affected products
- npm eslint-config-eslint 5.0.2
Timeline
- 2020-09-01: disclosed
- 2020-08-31: advisory