CALL TO ACTION Supply Chain Attack – High Risk from compromised npm (Java) maintenance account

Dear Colleague,

We would like to inform you that the supply chain attack that compromised multiple maintainer accounts for npm, the popular JavaScript package manager, and the subsequent injection of malicious code, has expanded, and compromises have been detected across a large number of packages.

If the libraries in use on your systems are included among those listed in the links below, you must perform the following remediation actions as soon as possible:

• Check the versions of the packages in use:
  • Ensure you are not using compromised versions of the packages listed in the table;
• Clean the npm cache:
  • Command: npm cache clean –force to prevent malicious versions from being reused;
• Reinstall all dependencies:
  • Delete node_modules and reinstall the packages from scratch;
• Use a package lock and pinned versions:
  • Lock dependency versions (package-lock.json or yarn.lock) to prevent automatic updates to compromised versions;
• Perform version pinning:
  • Accurately specify the version of critical packages to prevent unverified updates;
• Rotate npm tokens and other exposed secrets:
  • If compromised packages were installed on machines with publishing credentials, regenerate npm tokens and any other potentially exposed secrets (e.g., API keys, cloud credentials);
• Regularly audit dependencies:
  • Use tools such as npm audit, yarn audit, or semgrep to identify vulnerable or compromised packages.

The following links provide lists of npm library packages affected by malicious activity:

• https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages
• https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages
• https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
• https://socket.dev/blog/duckdb-npm-account-compromised-in-continuing-supply-chain-attack

  Cordiali saluti / Best Regards
  _____________________­­­­­­­­­­­­___________________________________________

  Group Information Security Office
  security@eng.it
  Engineering Ingegneria Informatica S.p.A.
  Piazzale dell’Agricoltura, 24 – 00148 Roma (RM)
  www.eng.it