The PureScript npm Installer Sabotage

What happened

The PureScript installer is a package that downloads a prebuilt compiler. Its maintainers took over from the original author, Shinnosuke Watanabe (@shinnn), after a disagreement, according to The Register. The PureScript 0.13.2 release on 5 July 2019 was the first from the new team.

The PureScript maintainer's write-up gives this timeline in UTC:

• 5 July, about 21:00: load-from-cwd-or-npm@3.0.2 published
• 9 July, about 01:00: a user, @doolse, identified the problem
• 9 July, about 05:00: clean load-from-cwd-or-npm@3.0.4 published
• 9 July, about 08:00: rate-map@1.0.3 published
• 9 July, about 11:30: the code in rate-map found
• 9 July, about 14:00: a fixed installer, 0.2.5, released

The first package returned a PassThrough stream instead of the expected package, so the installer hung at the step that checks for a prebuilt binary. The second package removed callback behavior and deleted itself to hide evidence. The code ran only when the PureScript installer used it, and not when the original author's own packages did.

Watanabe said an attacker gained access to his npm account. The Register notes that this is not settled.

Affected versions

• load-from-cwd-or-npm 3.0.2 (clean 3.0.4 followed)
• rate-map 1.0.3
• The PureScript npm installer before the fix, which depended on these packages

Both malicious versions were later removed from the registry. The write-up recommends upgrading to PureScript 0.13.2 or later, and says the maintainers removed or copied into their own code all dependencies by @shinnn. This is only partly detectable by comparing files. The 3.0.2 change gave the package no new capability, because it only returned a wrong value.

Indicators of compromise

• load-from-cwd-or-npm version 3.0.2 in a lockfile or node_modules
• rate-map version 1.0.3 in a lockfile or node_modules
• An install of purescript that hangs at the message "Check if a prebuilt binary is provided for your platform"

How to check

List the two packages in your dependency tree.

npm ls load-from-cwd-or-npm rate-map

Search lockfiles for the bad versions.

grep -rnE "load-from-cwd-or-npm|rate-map" package-lock.json yarn.lock 2>/dev/null

What to do now

1. Update purescript to 0.13.2 or later.
2. Remove or update load-from-cwd-or-npm and rate-map so that no bad version remains.
3. Reinstall dependencies from a clean lockfile.
4. Treat package maintainer disputes as a risk signal. Pin versions and review dependency updates.

Vigilance compares the version you trust with a new one and reports the file that gained a new capability. See all attacks.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 64

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    index.js
           It now downloads from the internet. It did not before.

Sources

1. harry.garrood.me/blog/malicious-code-in-purescript-npm-installer/
2. theregister.com/2019/07/15/purescripts_npm_installer/