Executive brief
eslint-scope is a widely-used JavaScript library for scope analysis used by major tools like ESLint, Babel, and Webpack. A malicious version (3.7.2) was published after an attacker compromised a maintainer's npm account. The malicious code extracted npm authentication tokens from users' .npmrc files and sent them to remote servers, potentially allowing the attacker to publish packages impersonating affected users.
Technical details
Version 3.7.2 of eslint-scope was published without authorization after an attacker gained access to a maintainer's npm account (likely via credential reuse and lack of two-factor authentication). The malicious code performed supply-chain code injection: upon installation, a post-install script downloaded and executed code from pastebin.com that read the user's .npmrc file (containing npm authentication tokens) and transmitted it to attacker-controlled servers. The same malicious pattern was injected into eslint-config-eslint@5.0.2. Both packages were unpublished within hours and npm revoked all tokens issued before 2018-07-12 12:30 UTC as a precaution.
Affected products
- eslint eslint-scope 3.7.2
- eslint eslint-config-eslint 5.0.2
Timeline
- 2018-07-12: other: Malicious versions eslint-scope@3.7.2 and eslint-config-eslint@5.0.2 published
- 2018-07-12: disclosed
- 2018-07-12: patched: Malicious versions unpublished from npm registry; eslint-scope fixed in 3.7.3
- 2018-07-12: other: npm revoked all access tokens issued before this time