Supply-Chain Attack Hits 2 Billion Downloads: Nearly Two Dozen Open-Source Packages Compromised

Software Packages with Over 2 Billion Weekly Downloads Hit in Supply-Chain Attack A massive supply-chain attack has compromised nearly two dozen open-source software packages hosted on the npm repository, with over 2 billion weekly downloads. The attack, which came to public notice on Monday, is believed to be one of the largest of its kind ever. According to Josh Junon, a maintainer or co-maintainer of the affected packages, he was compromised after falling for an email that claimed his account would be closed unless he logged in and updated his two-factor authentication credentials. "Defeating 2FA the easy way," Junon wrote on social media, acknowledging his mistake. Within an hour of the compromise, dozens of open-source packages overseen by Junon received updates that added malicious code for transferring cryptocurrency payments to attacker-controlled wallets. The attackers wasted no time capitalizing on the breach, highlighting the speed and efficiency with which they operated. The npm repository is a vast collection of open-source software packages used by developers worldwide. With over 2 billion weekly downloads, it's one of the most widely used package managers in the industry. The attack raises concerns about the security of the supply chain and the potential for widespread damage. "It's a wake-up call for the entire development community," said Mark Cox, a cybersecurity expert at Red Hat. "This attack highlights the importance of securing not just individual packages but also the underlying infrastructure that supports them." The affected packages include popular libraries such as express, react, and vue. While it's unclear how many users have been impacted, experts warn that the malicious code could be embedded in a wide range of applications. "This is a classic case of a supply-chain attack," said Cox. "The attackers exploited a vulnerability in the package maintainer's account to inject malicious code into the packages. It's a reminder that security is not just about individual packages but also about the entire ecosystem." As the situation unfolds, npm has taken steps to contain the damage and prevent further attacks. The company has removed the compromised packages from its repository and is working with developers to identify and update affected applications. The incident serves as a stark reminder of the importance of security in software development and the need for robust measures to protect against supply-chain attacks. As Cox noted, "This attack should prompt developers to review their security practices and ensure that they are doing everything possible to prevent similar breaches." Background: npm is a popular package manager used by millions of developers worldwide. The repository hosts over 1 million packages, with many receiving tens of thousands of downloads per week. Additional Perspectives: "This attack highlights the importance of implementing robust security measures in software development," said Cox. "The speed and efficiency of the attackers are a concern," added Junon. "We need to do better at securing our infrastructure." Current Status: npm has removed the compromised packages from its repository, and developers are working to update affected applications. Next Developments: As the situation unfolds, experts expect further analysis and investigation into the attack. The incident is likely to prompt a wider discussion about supply-chain security and the need for robust measures to protect against similar breaches. *Reporting by Arstechnica.*