Skip to main content

SUP-COMPROMISE-003 Malicious postinstall

A direct or transitive dependency matches a catalogued malicious_postinstall incident: the package ships a lifecycle script (npm postinstall or preinstall, PyPI setup.py) that runs attacker code the moment npm install or pip install resolves it. The payload has likely already run on every developer machine, CI runner and build server where it was installed. Treat a hit as an incident.

What Vulkro detects​

Every (ecosystem, name, version) found by the dependency scan is looked up in the curated compromised-release catalog. A row of kind malicious_postinstall whose versions[] contains the installed version produces this finding.

Severity comes from the catalog row (typically Critical). Confidence High. Evidence signal: compromised-release-exact-version-match, weight 1.0.

Catalogued incidents include:

  • INCIDENT-2022-ctx (PyPI ctx@0.2.2..0.2.6): an abandoned package republished to exfiltrate AWS credentials and environment variables from setup.py.
  • INCIDENT-2023-coloramaa (PyPI coloramaa@0.4.6): a colorama typosquat that installed an info-stealer.

Non-compliant code​

Any lockfile or requirements.txt resolving to this runs the payload on the next pip install.

ctx==0.2.2

Compliant code​

Remove the dependency. If you need the original library, use it only if a trusted maintainer has republished it; otherwise vendor the last known-good source.

How to fix​

  • Uninstall now.
  • Reprovision affected hosts where feasible. Rebuild CI runners from a clean image and do not trust artefacts from affected runs; on workstations, at minimum scan for malware, check shell history for outbound activity, and rotate the account's credentials.
  • Rotate every credential in scope, starting with environment variables (cloud keys, database passwords, API tokens).
  • Check the advisory for indicators of compromise: domains contacted, files dropped, processes spawned.
  • Run vulkro respond to find the same (name, version) in your other projects.

References​

See also: vulkro scan, SUP-COMPROMISE-002, SUP-COMPROMISE-004.

Last updated on