What We Do
How We Do
Resources
Company
Partners
Get Started
Security advisories

COA NPM Supply Chain Attack

November 4, 2021 | 1 MIN READ

Speak With A Security Expert Now

TALK TO AN EXPERT

THE THREAT

On November 4th, 2021, threat actors hijacked the NPM library COA, and uploaded malicious versions of the library for victims to download. COA is a widely used open-source parser for command line options. The malicious COA versions appear to deliver the DanaBot malware; a trojan capable of stealing sensitive information such as credentials, as well as downloading and executing additional malicious content. It should be noted that at the time of this reporting, the malicious NPMs have been removed from the NPM COA page.

eSentire has observed activity related to this campaign. Organizations making use of the COA NPM library are strongly recommended to ensure that only the legitimate version is in use.

What we’re doing about it

What you should do about it

Additional information

Observed malicious versions on COA are as follows:

Implementation of these malicious versions has been reported to cause disruptions in React packages that depend on COA. The malicious versions have since been removed; malicious versions were only available for a few hours before their removal.

This activity is extremely similar to the supply chain attack involving the UA-Parser-JS NPM library that occurred on October 22nd. Deployment of cryptominers has not yet been identified in the current COA campaign.

References:

[1] https://github.com/veged/coa/issues/99#issue-1044749810
[2] https://www.npmjs.com/package/coa
[3] https://www.esentire.com/security-advisories/npm-library-supply-chain-attack

View Most Recent Advisories