Executive brief
The popular JavaScript library ua-parser-js, used to identify browser and device information, was compromised by an unauthorized party who injected malicious code into several versions. This malware includes a cryptocurrency miner and a backdoor that could allow attackers to steal sensitive data or take full control of affected systems. Organizations using the impacted versions should consider their systems fully compromised and rotate all credentials and secrets.
Technical details
This is a supply chain attack involving the injection of malicious functionality (CWE-912) into the ua-parser-js npm package. Versions 0.7.29, 0.8.0, and 1.0.0 were modified by an attacker to include a cryptocurrency miner and a backdoor capable of executing arbitrary commands. The attack vector is network-based, triggered when a user or automated system installs or runs the compromised package versions. Successful exploitation results in full system compromise, including the potential theft of environment variables, secrets, and persistent remote access. Users must upgrade to versions 0.7.30, 0.8.1, or 1.0.1 and perform a full incident response on affected machines.
Affected products
- faisalman ua-parser-js 0.7.29, 0.8.0, 1.0.0
Timeline
- 2021-10-22: disclosed: Initial discovery of compromised packages
- 2021-10-22: patched: Clean versions 0.7.30, 0.8.1, and 1.0.1 released
- 2022-05-25: advisory: Initial publication of this advisory record