COA NPM Supply Chain Attack

THE THREAT

On November 4th, 2021, threat actors hijacked the NPM library COA, and uploaded malicious versions of the library for victims to download. COA is a widely used open-source parser for command line options. The malicious COA versions appear to deliver the DanaBot malware; a trojan capable of stealing sensitive information such as credentials, as well as downloading and executing additional malicious content. It should be noted that at the time of this reporting, the malicious NPMs have been removed from the NPM COA page.

eSentire has observed activity related to this campaign. Organizations making use of the COA NPM library are strongly recommended to ensure that only the legitimate version is in use.

What we’re doing about it

• eSentire MDR for Network has rules in place to detect DanaBot
• Techniques observed in this campaign are detected via eSentire MDR for Endpoint
• Threat hunts for Indicators of Compromise (IoCs) and TTPs have been performed for all eSentire MDR for Endpoint customers
  • Impacted customers have been notified directly
• eSentire is actively tracking this threat for additional details and detection opportunities

What you should do about it

• Ensure that only the most recent, non-malicious version of COA is in use (version 2.0.2 – released December 2018)
• If malicious versions were installed, impacted devices should be treated as compromised and user credentials must be reset

Additional information

Observed malicious versions on COA are as follows:

• 2.0.3
• 2.0.4
• 2.1.1
• 2.1.3
• 3.1.3

Implementation of these malicious versions has been reported to cause disruptions in React packages that depend on COA. The malicious versions have since been removed; malicious versions were only available for a few hours before their removal.

This activity is extremely similar to the supply chain attack involving the UA-Parser-JS NPM library that occurred on October 22nd. Deployment of cryptominers has not yet been identified in the current COA campaign.

References:

[1] https://github.com/veged/coa/issues/99#issue-1044749810
[2] https://www.npmjs.com/package/coa
[3] https://www.esentire.com/security-advisories/npm-library-supply-chain-attack