Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Embedded Malware in Coa

github.com

Post reply on HN
Print view View original

11–20 of 86 posts

Re: Embedded Malware in Coa

#11

Post by raesene9 »

Earlier post (https://news.ycombinator.com/item?id=29111279).

The thing that should be causing concern is not so much these very loud obvious attacks, but how many better attacks that are harder to detect, are currently happening.

With 1.7M packages and an ecosystem that favours lots of 3rd party package usage, NPM is a large target. Whilst NPM isn't the only repository to have this kind of issue, it's definitely the largest attack surface.

Re: Embedded Malware in Coa

#14

Post by strogonoff »

d3nj4l wrote: post #9
perihelions wrote: post #6

Earlier quoted context omitted.

"Bleeping Computer" published screenshots of it (and also has some analysis), https://www.bleepingcomputer.com/news/security/popular-coa-n...

This should be a top-level comment, if not a post in its own right - it explained the entirety of the situation way better than TFA.

That post doesn’t say much about `coa`, besides “new versions started appearing and builds started failing”. The bug report linked from GitHub advisory does a good job of describing the issue, though: https://github.com/veged/coa/issues/99

Re: Embedded Malware in Coa

#15

Post by cloudbonsai »

For anyone interested, the malicious code can be found in the following link:

https://github.com/veged/coa/issues/99#issuecomment-96153687...

TLDR: The attacker injected an attack code as coa's `preinstall` script, which executes an obscurely-named file ("compile.bat"). This file is fully obfuscated, but what it does is basically to pull exploit DLLs from the attacker's server and install 'em.

I think the fortunate part of this accident is that the attacker failed to deploy the malware in his/her first attempt; v2.0.3 only contained the half of the changeset that the exploit needs to work (which accidentally broke tons of CI builds); So some developers could notice that something is wrong a bit early.

Re: Embedded Malware in Coa

#16

Post by inbx0 »

capableweb wrote: post #5

What a worthless advisory, how about sharing who could possibly be affected at the very top, or at least anywhere? Going to the issue, it seems the `preinstall` field was changed to `start /B node compile.js & node compile.js",` which means this would only run on Windows machines, everyone else seems to be unaffected. Here is how you can find out if you have the affected package on your machine/instance: find ~/proje…

-name "*coa*" is a bit too eager. It will flag other packages too, like the fairly popular babel-plugin-nullish-coalescing

Re: Embedded Malware in Coa

#17

Post by rafaelturk »

As bad as this may sound, this is why a love Open Source, npm and the JavaScript ecosystem. It super easy to audit and check the code.

What is missing is more automated and recurrent checks in all the packages and downstream dependencies.

Re: Embedded Malware in Coa

#18

Post by SahAssar »

jcfrei wrote: post #13

How do you add a new version to npm? Was the devs account hacked or how does that work?

The most common ways these things seem to happen is either password reuse with no 2fa or that the npm token (in ~/.npmrc) was harvested by another compromised package/program. IIRC there were a few that were due to phishing too.

Re: Embedded Malware in Coa

#19

Post by zibzab »

rafaelturk wrote: post #17

As bad as this may sound, this is why a love Open Source, npm and the JavaScript ecosystem. It super easy to audit and check the code. What is missing is more automated and recurrent checks in all the packages and downstream dependencies.

That exists already, for example github does it automatically for you.

However, that is dependent on first finding and flagging issues, which is exactly what this post is about.

Re: Embedded Malware in Coa

#20

Post by TonyTrapp »

haunter wrote: post #3

Is https://www.virustotal.com good? I saw it referenced but never used

It gives you a good glance how likely it is that something is a threat - if an overwhelming majority of AV products detect it, it's quite likely that it's bad, and if only a few products find it, it's either very new or really just a bunch of false positives. Like many things, there's no simple "yes" or "no" answer, thus interpreting Virustotal output still requires some literacy on that topic. The site can also help software vendors to find which AV products reject their software, so that they can file false-positive requests to those AV vendors.
Post reply on HN