Shai-Hulud keeps burrowing: 314 npm packages infected after another account compromise
Popular JavaScript modules including size-sensor and echarts-for-react hit as hijacked account closed GitHub warnings
An npm account compromise infected 314 npm packages with malware, including size-sensor, echarts-for-react, timeago.js,and packages scoped to @antv, in a 22-minute burst of activity in the early hours of Tuesday morning.
The most popular impacted package is size-sensor, downloaded4.2 million times per month, followed by echarts-for-react (3.8 million), @antv/scale(2.2 million) and timeago.js (1.15 million).
The compromised account, i@hust.cc, belongs to a developer based inHangzhou, China. Security researcher Nicholas Carlini reported the malware on GitHub, and the the hust.cc account closed the issues and marked them as "fixed" within an hour. This means the malware report on thisand other repositories is hidden unless a developer looks for closed issues.
Some malicious package versions have been deprecated on npm with the message "thisversion was published in error, please use the latest version instead,"while others have been removed.
...
Copyright of this story solely belongs to theregister.com. To see the full text click HERE
