Embedded Malware in Coa
github.com
Embedded Malware in Coa
1–10 of 86 posts
Re: Embedded Malware in Coa
#2For anyone else wondering, Coa is a CLI arg parser for Node.
Re: Embedded Malware in Coa
#3Is https://www.virustotal.com good? I saw it referenced but never used
Re: Embedded Malware in Coa
#4A separate advisory says the npm package "rc" is also compromised. That's also a highly popular one, according to the npmjs stats (1,323 dependents; 14.2 million weekly downloads).
https://github.com/advisories/GHSA-g2q5-5433-rhrf (" Embedded malware in rc" "critical severity")
Notable that both advisories link to the virustotal entry for the same file hash (same malware).
@dang Could the title be updated to include the names of other affected packages?
Re: Embedded Malware in Coa
#5What a worthless advisory, how about sharing who could possibly be affected at the very top, or at least anywhere?
Going to the issue, it seems the `preinstall` field was changed to `start /B node compile.js & node compile.js",` which means this would only run on Windows machines, everyone else seems to be unaffected.
Here is how you can find out if you have the affected package on your machine/instance:
find ~/projects/ -name "*coa*" | xargs -I {} jq .version {}/package.json 2>/dev/null
Edit: is anyone sitting on the source for `compile.js` as mentioned? Would be interesting to see.
Re: Embedded Malware in Coa
#6What a worthless advisory, how about sharing who could possibly be affected at the very top, or at least anywhere? Going to the issue, it seems the `preinstall` field was changed to `start /B node compile.js & node compile.js",` which means this would only run on Windows machines, everyone else seems to be unaffected. Here is how you can find out if you have the affected package on your machine/instance: find ~/proje…
"Bleeping Computer" published screenshots of it (and also has some analysis),
https://www.bleepingcomputer.com/news/security/popular-coa-n...
Re: Embedded Malware in Coa
#7The Coa NPM package has 8.8 million weekly downloads. The vast majority of the downloads is from being a dependency in other packages.
Is it possible to check how many downloaded the compromised versions?
Re: Embedded Malware in Coa
#8What exactly is the malicious code? I assume it's in `compile.js` and only can be found in published (now removed) npm package instead of source code repo?
Re: Embedded Malware in Coa
#9What a worthless advisory, how about sharing who could possibly be affected at the very top, or at least anywhere? Going to the issue, it seems the `preinstall` field was changed to `start /B node compile.js & node compile.js",` which means this would only run on Windows machines, everyone else seems to be unaffected. Here is how you can find out if you have the affected package on your machine/instance: find ~/proje…
"Bleeping Computer" published screenshots of it (and also has some analysis), https://www.bleepingcomputer.com/news/security/popular-coa-n...
This should be a top-level comment, if not a post in its own right - it explained the entirety of the situation way better than TFA.
Re: Embedded Malware in Coa
#10What exactly is the malicious code? I assume it's in `compile.js` and only can be found in published (now removed) npm package instead of source code repo?
There's some details here:
https://www.bleepingcomputer.com/news/security/popular-coa-n...
>"Based on our analysis and information seen thus far, the malware is likely the Danabot password-stealing Trojan for Windows."