npm ua-parser-js hijack

[vielmetti]

report this a.m. of https://www.npmjs.com/package/ua-parser-js being hijacked in NPM - I don't have much more in the way of details yet.

[vielmetti]

some detail on https://snyk.io/vuln/npm:ua-parser-js

[vielmetti]

This looks like a relevant story https://blog.sonatype.com/newly-found-npm-malware-mines-cryptocurrency-on-windows-linux-macos-devices

[vielmetti]

The relevant issue from Github faisalman/ua-parser-js#536

[adityasaky]

All of this looks very relevant, thanks! I'll shortly either update it here or at https://github.com/cncf/tag-security/tree/main/supply-chain-security/compromises. This reminds me of event-stream, which is already listed there. Going by faisalman/ua-parser-js#536 (comment)

[adityasaky]

Tracking it here: cncf/tag-security#812

[adityasaky]

Thanks for bringing it up here! Did you hear of it from a particular channel / mailing list etc? Because if so, I'd like to join it and keep an eye out for other instances.

[adityasaky]

Closing in favour of the tag-security thread.

[vielmetti]

I heard about it from a channel in my coworking space's Slack - not a dedicated security channel.

[adityasaky]

Gotcha. Thank you!

[adityasaky]

cncf/tag-security#812