Skip to main content

SUP-COMPROMISE-004 Backdoored release

A direct or transitive dependency matches a catalogued backdoor_release incident: the package's own author deliberately added harmful behaviour to a specific release. Unlike SUP-COMPROMISE-001, the publisher's account was not hijacked; the legitimate publisher is the source. Cases range from protest payloads (the peacenotwar family) to sabotage such as deliberate infinite loops.

What Vulkro detects​

Every (ecosystem, name, version) found by the dependency scan is looked up in the curated compromised-release catalog. A row of kind backdoor_release whose versions[] contains the installed version produces this finding.

Severity comes from the catalog row (typically Critical). Confidence High. Evidence signal: compromised-release-exact-version-match, weight 1.0.

Catalogued incidents include:

  • INCIDENT-2022-colors (npm colors@1.4.1, 1.4.2): an infinite loop that broke thousands of downstream builds.
  • INCIDENT-2022-node-ipc (npm node-ipc@10.1.1..10.1.3): the peacenotwar payload that deleted files on machines geolocated to Russia or Belarus.

Non-compliant code​

node-ipc@10.1.1 is inside the catalogued window.

{
  "lockfileVersion": 3,
  "packages": {
    "node_modules/node-ipc": {
      "version": "10.1.1",
      "resolved": "https://registry.npmjs.org/node-ipc/-/node-ipc-10.1.1.tgz"
    }
  }
}

Compliant code​

Pin a clean version published before the backdoor, or a verified clean fork. The advisory in the finding lists known-good versions on either side of the window.

How to fix​

  • Remove the affected version and pin a clean one.
  • Review logs and outbound traffic from while it was in use; the advisory describes the specific behaviour.
  • On machines that ran it, check the filesystem for damage (file deletion in the peacenotwar case).
  • Rotate credentials the host could see: a non-network payload still shared a process with them.
  • Run vulkro respond to find the same version in your other projects.

References​

See also: vulkro scan, SUP-COMPROMISE-003, SUP-COMPROMISE-005.

Last updated on