How Can You Protect Your Computer From Infected 'COA' and 'rc' NPM Packages?

Recently, the globe has witnessed another supply chain attack. This time attackers cleverly infected two popular NPM packages: COA and rc, with password-stealing malware to create a backdoor on the victim computers. Let’s see how can you protect your computer from infected COA and rc NPM packages.

Victims Of The Infected NPM Packages:

No discrimination has been seen in terms of the victims. Since it is a supply chain attack, the one who installs the infected package would become a victim. It’s been said that these two NPM packages were downloaded 22 million times in a week of time altogether.

What Is NPM?

npm is the world’s largest Software Library(Registry). npm has more than 800,000 packages in its software registry. npm is not only a software registry but also a software Package Manager and Installer. It is released under an open-source license and made free to use. Anybody can download and npm and its public software packages without any registration or login. So many organizations use npm in their private developments. 

How To Install NPM And Its Packages?

npm will get installed when you download and install Node.js. You should install Node.js to install npm. You can learn how to install or upgrade Node.js from this page.

What Are COA And rc NPM Packages?

COA (Command-Option-Argument) is a parser for command-line options. It aims to get maximum profit from formalization of your program API. You can read more about COA from its official site. 
rc is the non-configurable configuration loader. Visit this page to learn rc with its usage, formats, standards, and with live examples.

Infected Versions Of COA And rc Packages:

How To Protect Your Computer from Infected ‘COA’ And ‘rc’ NPM Packages?

If you are running COA with any one of the affected versions (v2.0.3 and above), then please downgrade your COA to 2.0.2 as soon as possible and check for suspicious activities.

In the same way, if you are running the affected versions (1.2.9, 1.3.9, and 2.3.9) of rc npm package on your computer, then downgrade your rc package to 1.2.8 as soon as possible and check for suspicious activities.

Any computer that has affected versions of COA and rc packages installed or running on them should be considered fully compromised and you should do these steps to neutralize the infections.

1. Unplug the network cable and isolate the machine from the network. You can keep the computer untouched if you want to carry out the threat analysis to identify IOCs.
2. Initiate the full image backup or filesystem backup from a clean backup snapshot. Restore the machine with clean image.
3. If you don’t have the backup, then immediately downgrade the npm package to the ininfected versions as suggested above.
4. Removal of the package doesn’t guarantee that infection has been removed. All secrets and keys stored on that computer should be rotated immediately from a different computer.
5. Run all the security checks on the infected system and make sure your machine is not infected with the malware.

Run these checks on the suspected machines:

1. Check for unusual accounts created, especially in the administrator’s group
2. Check for unusual big files on the storage, bigger than five GB
3. Check for any unusual files added recently in system folders
4. Check for files using the “hidden” attribute Property
5. Check for unusual programs launched at boot time in the windows registry
6. Check all running processes for unusual/unknown entries, especially processes with username “system” and “administrator.”
7. Check user’s autostart folders
8. Check for unusual/unexpected network services installed and started
9. Check for unusual network activity
10. Check at the opened sessions on the machine
11. Check for unusual automated tasks
12. Check for unusual log entries
13. Check for any rootkit
14. Run an anti-virus product on the whole disk to check for any malware

We hope this post will help you in learning How Can You Protect Your Computer from Infected ‘COA’ and ‘rc’ NPM Packages. Thanks for reading this threat post. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this.

• 14 things to check when a system gets compromised
• What are the different types of phishing attacks?
• 8 Malicious Python Libraries Found on PyPI – Remove Them As Soon As Possible
• Step-by-Step Procedure to Install Apache From Source Code on Ubuntu
• Fix Critical Vulnerabilities Found in Pentaho Business Analytics Software