Skip to main content

SUP-COMPROMISE-001 Hijacked publish

A direct or transitive dependency matches a catalogued hijacked_publish incident: an attacker stole a maintainer's publish credentials and pushed a malicious version under the real package name. The package is fine; a specific version range is poisoned, and installing it runs the attacker's code.

What Vulkro detects​

Every (ecosystem, name, version) found by the dependency scan (lockfiles and manifests across npm, PyPI, Cargo, Go and system packages) is looked up in the curated compromised-release catalog. A row of kind hijacked_publish whose versions[] contains the installed version produces this finding.

Severity comes from the catalog row (Critical, High, Medium, Low). Confidence High. Evidence signal: compromised-release-exact-version-match, weight 1.0, source Pattern. Manifest-only entries with no resolved version are skipped.

Catalogued incidents include:

  • INCIDENT-2018-event-stream (npm event-stream@3.3.6, 3.3.7): flatmap-stream payload targeting BTC wallets.
  • INCIDENT-2021-ua-parser-js (npm ua-parser-js@0.7.29, 0.8.0, 1.0.0): crypto-miner and credential stealer.
  • INCIDENT-2018-eslint-scope (npm eslint-scope@3.7.2): exfiltrated npm tokens from CI.
  • INCIDENT-2021-coa and INCIDENT-2021-rc (npm): the November 2021 credential-reuse cluster.
  • INCIDENT-2024-lottie-player (npm @lottiefiles/lottie-player@2.0.5..2.0.7): Web3 drainer.
  • INCIDENT-2024-solana-web3-js (npm @solana/web3.js@1.95.6, 1.95.7): private-key exfiltrator.

Non-compliant code​

event-stream@3.3.6 matches INCIDENT-2018-event-stream.

{
  "lockfileVersion": 3,
  "packages": {
    "node_modules/event-stream": {
      "version": "3.3.6",
      "resolved": "https://registry.npmjs.org/event-stream/-/event-stream-3.3.6.tgz"
    }
  }
}

Compliant code​

Any version outside the catalogued range is fine.

{
  "lockfileVersion": 3,
  "packages": {
    "node_modules/event-stream": {
      "version": "4.0.1",
      "resolved": "https://registry.npmjs.org/event-stream/-/event-stream-4.0.1.tgz"
    }
  }
}

How to fix​

  • Move to a clean version from after the incident, or the last clean one before it. The advisory URL in the finding gives the affected range.
  • Audit build artefacts produced while the bad version was in the tree.
  • Rotate every credential the build hosts could see in that window: registry tokens, cloud keys, source-control tokens, environment variables.
  • Run vulkro respond to find the same (name, version) in your other projects.

References​

See also: vulkro scan, SUP-COMPROMISE-002, MCP-006.

Last updated on