NPM UA-Parser-JS Poisoned with Trojans

A supply chain attack compromised the popular UAParser.js package on the NPM repository, allowing threat actors to distribute malicious scripts to users of both Windows and Linux systems. The attackers injected a malicious script named preinstall.js, which was executed during package installation and enabled the deployment of additional malware.

For Linux systems, the malicious script executed preinstall.sh, which first checked the victim's geolocation and excluded systems located in Russia, Ukraine, Belarus, and Kazakhstan. If the target was outside these countries, the script downloaded a cryptocurrency mining malware (jsextension) from the IP address 159[.]148[.]186[.]228. The miner was configured to utilize only a portion of the system's CPU resources to reduce the likelihood of detection.

For Windows systems, the attack followed a similar process but additionally downloaded a credential-stealing trojan (sdd.dll), which was saved as create.dll and executed using the regsvr32.exe -s create.dll command. The malware was designed to steal credentials from multiple applications, including web browsers, email clients, FTP clients, VNC software, and messaging applications.

The incident demonstrates how attackers can abuse trusted third-party software dependencies to distribute malware at scale, making it a significant Supply Chain compromise affecting downstream users and organizations.