Executive brief
The rc npm package, a configuration loader used by millions of developers, had malicious code injected into specific versions (1.2.9, 1.3.9, 2.3.9) following account compromise. Any system with affected versions installed should be considered fully compromised, with all credentials, secrets, and encryption keys rotated immediately from a different computer. The malware downloads and executes additional payloads including the Qakbot trojan, providing an attacker complete control of the affected system.
Technical details
This vulnerability exploits a compromised npm package maintainer account to inject malicious code into the rc configuration loader library. The attack vector is supply-chain compromise: when developers install the affected versions via npm, a post-installation script executes obfuscated TypeScript code that detects the operating system and downloads platform-specific payloads (Windows batch or Linux bash scripts). These scripts in turn download and execute a DLL file containing Qakbot malware, giving attackers arbitrary code execution with the privileges of the installing user. The vulnerability requires no authentication or network preconditions beyond standard package installation. Affected versions are 1.2.9, 1.3.9, and 2.3.9; users should downgrade to version 1.2.8 immediately, though full system remediation is recommended due to the severity of trojan infection.
Affected products
- npm rc 1.2.9, 1.3.9, 2.3.9
Timeline
- 2021-11-04: disclosed: Malicious rc versions detected and removed from npm
- 2021-11-04: other: npm security team disabled compromised developer account