The Rspack and Vant Supply Chain Attack

What happened

Attackers got npm tokens that belonged to team members and used them to publish poisoned versions. Sonatype reports that the packages held heavily obfuscated code in a config file under dist/utils/. In vant the file is support.js. BleepingComputer names support.js for @rspack/core and config.js for @rspack/cli, so the sources differ on which file sits in which package.

A postinstall script starts the code. The code looks up the machine's location and network details through the ipinfo.io service. It sends data to a remote server at 80.78.28.72. It then downloads and runs XMRig, a Monero miner. BleepingComputer adds that the miner is limited to 75 percent of the processor threads.

The Hacker News says the Rspack team unpublished the bad versions as soon as they found them. The team told users to invalidate all npm and GitHub tokens and said it was still investigating the root cause of the token theft.

Affected versions

• @rspack/core 1.1.7 (about 394,000 weekly downloads).
• @rspack/cli 1.1.7 (about 145,000 weekly downloads).
• vant 2.13.3, 2.13.4, 2.13.5, 3.6.13, 3.6.14, 3.6.15, 4.9.11, 4.9.12, 4.9.13, 4.9.14 (about 46,000 weekly downloads).
• Safe: 1.1.6, or 1.1.8 and later for Rspack. 4.9.15 and later for vant.

Indicators of compromise

• Remote server: 80.78.28.72 (Sonatype lists the path /tokens).
• Location lookup to ipinfo.io/json from a build or install step.
• Monero wallet address in the miner configuration: 475NBZygwEajj4YP2Bdu7yg6XnaphiFjxTFPkvzg5xAjLGPSakE68nyGavn8r1BYqB44xTEyKQhueeqAyGy8RaYc73URL1j
• A miner file named /tmp/vant_helper in the vant variant.
• An unexpected XMRig process that uses a high share of CPU.
• A postinstall script in the installed package that you did not see before.

Sonatype tracks the issue as sonatype-2024-013290.

How to check

Find every copy of the affected packages in your projects.

npm ls @rspack/core @rspack/cli vant

On Linux hosts and CI runners, look for the miner process and the helper file.

ps aux | grep -i xmrig; ls -l /tmp/vant_helper

Search installed code for the server address.

grep -rl "80.78.28.72" node_modules/@rspack node_modules/vant

What to do now

1. Upgrade @rspack/core and @rspack/cli to 1.1.8 or later and vant to 4.9.15 or later.
2. Remove node_modules and reinstall from a clean lockfile.
3. Stop and remove any miner process on machines that installed a bad version.
4. Rotate npm and GitHub tokens that were present on those machines. The Hacker News reports that the malware also sent cloud service credentials to the remote server.
5. Block 80.78.28.72 at your firewall.
6. Audit repository permissions and turn on two-factor authentication for publishers.

Vigilance compares the version you trust with a new one. Here, a helper file in a build tool gained a geolocation lookup and a download-and-run step. Vigilance reports that new capability in the file.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 90 (1 Added)

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

NEW FILE   dist/utils/config.js
           It runs a command on its own when it is installed and downloads from the internet.

Sources

1. sonatype.com/blog/npm-packages-rspack-vant-compromised-blocked-by-sonatype
2. thehackernews.com/2024/12/rspack-npm-packages-compromised-with.html
3. bleepingcomputer.com/news/security/malicious-rspack-vant-packages-published-using-stolen-npm-tokens/