The ua-parser-js npm Supply Chain Attack

What happened

An attacker took over the package account and published three releases that ran a script at install time. Google Cloud (Mandiant) reports that the malicious versions went up between 16:14 and 16:25 UTC on 22 October 2021. The npm registry warning on the package said that it had been hijacked and told users to revert to 0.7.28.

Each release had a preinstall entry in package.json that ran preinstall.js. On Windows, the script downloaded two programs:

• jsextension.exe, a Monero cryptocurrency miner, fetched from 159.148.186[.]228.
• create.dll, the DanaBot banking trojan, fetched from citationsherbe[.]at/sdd.dll and run with regsvr32.exe -s create.dll.

On Linux, the script downloaded the same miner, named jsextension. It stopped if the machine was in Russia, Ukraine, Belarus or Kazakhstan. The script did nothing on macOS. DanaBot can run remote code, log keys, take screenshots and steal credentials.

Mandiant also lists later hijacks of coa and rc on 4 November 2021 that delivered a modified DanaBot DLL.

Vigilance compares the version you trust with the new one. These releases added a preinstall script and new files that 0.7.28 did not have. Vigilance reports the file that gained that capability. See the scan block below.

Affected versions

• ua-parser-js 0.7.29, 0.8.0 and 1.0.0.
• Patched: 0.7.30, 0.8.1 and 1.0.1.

Related incidents that Mandiant lists:

• coa 2.0.3, 2.0.4, 2.1.1, 2.1.3 and 3.1.3. Safe: 2.0.2.
• rc 1.2.9, 1.3.9 and 2.3.9. Safe: 1.2.8.

Indicators of compromise

• Files: preinstall.js, jsextension.exe (miner), jsextension (Linux miner), create.dll and sdd.dll.
• MD5 of jsextension.exe: fc724eb2894f34a3aca4b952d2f816cd.
• MD5 of sdd.dll (DanaBot): de8b54a938ac18f15cad804d79a0e19d.
• Download host: 159.148.186[.]228. Download domain: citationsherbe[.]at.
• DanaBot command servers (port 443): 185.158.250[.]216, 45.11.180[.]153, 194.76.225[.]46, 194.76.225[.]61.
• For coa and rc: the domain pastorcryptograph[.]at.

How to check

Show every copy of the package in the tree and in the npm cache.

npm ls ua-parser-js coa rc --all

grep -rEn "ua-parser-js@(0.7.29|0.8.0|1.0.0)|\"version\": \"(0.7.29|0.8.0|1.0.0)\"" package-lock.json

On a machine that possibly installed a bad version, also search for the dropped files, jsextension, jsextension.exe and create.dll.

What to do now

1. Upgrade to 0.7.30, 0.8.1 or 1.0.1. Check coa and rc too.
2. If a bad version installed, treat the machine as fully compromised. Rotate every secret and key from a different, clean system.
3. Remove the dropped files. The advisory warns that removing the package does not remove malware that its install script already placed.
4. Run a forensic review for unauthorized access.
5. Lock dependency versions and review install scripts before you update.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 16 (1 Added)

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

NEW FILE   preinstall.js
           It runs a command on its own when it is installed, downloads from the internet and reads saved passwords and access keys.

Sources

1. github.com/advisories/GHSA-pjwm-rvh2-c87w
2. cloud.google.com/blog/topics/threat-intelligence/supply-chain-node-js/
3. github.com/faisalman/ua-parser-js/issues/536