EXECUTIVE SUMMARY[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY[emaillocker id="1283"]
Recently, attackers hijacked the npm packages @rspack/core, @rspack/cli, and multiple versions of the Vue UI library Vant. Using stolen npm tokens, malicious versions of these packages were uploaded to the npm registry, potentially impacting thousands of developers. Automated malware detection systems identified the compromised versions—1.1.7 for Rspack packages and several versions of Vant—and promptly blocked them. Both project teams have since taken corrective measures to address the breach and secure future releases.
The compromised versions of @rspack/core and @rspack/cli, JavaScript bundlers written in Rust, included obfuscated malicious code in the dist/utils/config.js file. This code deployed XMRig, a Monero cryptocurrency miner, and attempted to connect to a suspicious server tokens. Monero's confidential transaction system has so far hindered tracing the activities tied to the attack. Similarly, multiple versions of Vant, a UI library for Vue, showed identical compromise patterns. These malicious releases also originated from a stolen npm token. Affected Vant versions included 2.13.x, 3.6.x, and 4.9.x series, with safe releases now available.
Both Rspack and Vant teams acknowledged the breaches and addressed the issue by deprecating the compromised versions and releasing secure updates. Measures have been taken to strengthen token management and enhance security processes. Users are advised to avoid the affected versions and switch to the secure ones to mitigate any potential risk.
THREAT PROFILE:
| Tactic | Technique ID | Technique |
| Execution | T1059 | Command and Scripting Interpreter |
| Persistence | T1547 | Boot or Logon Autostart Execution |
| Defense Evasion | T1027 | Obfuscated Files or Information |
| T1078 | Valid Accounts | |
| Command and Control | T1105 | Ingress Tool Transfer |
| Impact | T1496 | Resource Hijacking |
REFERENCES:
The following reports contain further technical details:
https://thehackernews.com/2024/12/rspack-npm-packages-compromised-with.html