{"id":424,"date":"2025-09-17T11:32:43","date_gmt":"2025-09-17T14:32:43","guid":{"rendered":"https:\/\/boasvindas.engdb.com.br\/?p=424"},"modified":"2026-04-06T12:18:54","modified_gmt":"2026-04-06T15:18:54","slug":"call-to-action-supply-chain-attack-high-risk-from-compromised-npm-java-maintenance-account","status":"publish","type":"post","link":"https:\/\/boasvindas.engdb.com.br\/?p=424","title":{"rendered":"CALL TO ACTION Supply Chain Attack &#8211; High Risk from compromised npm (Java) maintenance account"},"content":{"rendered":"<p style=\"font-weight: 400;\">Dear Colleague,<\/p>\n<p style=\"font-weight: 400;\">We would like to inform you that the supply chain attack that compromised multiple maintainer accounts for <strong>npm<\/strong>, the popular JavaScript package manager, and the subsequent injection of malicious code, has expanded, and compromises <strong>have been detected across a large number of packages.<\/strong><\/p>\n<p style=\"font-weight: 400;\"><strong>If the libraries in use on your systems are included among those listed in the links below, you must perform the following remediation actions as soon as possible:<\/strong><\/p>\n<ul style=\"font-weight: 400;\">\n<li><strong>Check the versions of the packages in use:<\/strong>\n<ul>\n<li>Ensure you are not using compromised versions of the packages listed in the table;<\/li>\n<\/ul>\n<\/li>\n<li><strong>Clean the npm cache:<\/strong>\n<ul>\n<li>Command: npm cache clean &#8211;force to prevent malicious versions from being reused;<\/li>\n<\/ul>\n<\/li>\n<li><strong>Reinstall all dependencies:<\/strong>\n<ul>\n<li>Delete node_modules and reinstall the packages from scratch;<\/li>\n<\/ul>\n<\/li>\n<li><strong>Use a package lock and pinned versions:<\/strong>\n<ul>\n<li>Lock dependency versions (package-lock.json or yarn.lock) to prevent automatic updates to compromised versions;<\/li>\n<\/ul>\n<\/li>\n<li><strong>Perform version pinning:<\/strong>\n<ul>\n<li>Accurately specify the version of critical packages to prevent unverified updates;<\/li>\n<\/ul>\n<\/li>\n<li><strong>Rotate npm tokens and other exposed secrets:<\/strong>\n<ul>\n<li>If compromised packages were installed on machines with publishing credentials, regenerate npm tokens and any other potentially exposed secrets (e.g., API keys, cloud credentials);<\/li>\n<\/ul>\n<\/li>\n<li><strong>Regularly audit dependencies:<\/strong>\n<ul>\n<li>Use tools such as npm audit, yarn audit, or semgrep to identify vulnerable or compromised packages.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p style=\"font-weight: 400;\"><strong>The following links provide lists of npm library packages affected by malicious activity:<\/strong><\/p>\n<ul style=\"font-weight: 400;\">\n<li><a href=\"https:\/\/socket.dev\/blog\/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages\" data-ogsc=\"\" data-outlook-id=\"600d1260-ca9e-4610-8671-92e327c8b6b4\">https:\/\/socket.dev\/blog\/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages<\/a><\/li>\n<li><a href=\"https:\/\/socket.dev\/blog\/tinycolor-supply-chain-attack-affects-40-packages\" data-ogsc=\"\" data-outlook-id=\"e8260299-093f-45dd-a7d9-dba82ce4af97\">https:\/\/socket.dev\/blog\/tinycolor-supply-chain-attack-affects-40-packages<\/a><\/li>\n<li><a href=\"https:\/\/socket.dev\/blog\/npm-author-qix-compromised-in-major-supply-chain-attack\" data-ogsc=\"\" data-outlook-id=\"890d906b-9f81-42f6-bada-83f3d0f7ff52\">https:\/\/socket.dev\/blog\/npm-author-qix-compromised-in-major-supply-chain-attack<\/a><\/li>\n<li><a href=\"https:\/\/socket.dev\/blog\/duckdb-npm-account-compromised-in-continuing-supply-chain-attack\" data-ogsc=\"\" data-outlook-id=\"1ef52d59-a126-40e1-b36d-6ebe25ed17b2\">https:\/\/socket.dev\/blog\/duckdb-npm-account-compromised-in-continuing-supply-chain-attack<\/a>\n<p style=\"font-weight: 400;\">\nCordiali saluti \/ Best Regards<br \/>\n_____________________\u00ad\u00ad\u00ad\u00ad\u00ad\u00ad\u00ad\u00ad\u00ad\u00ad\u00ad\u00ad___________________________________________<\/p>\n<p style=\"font-weight: 400;\" data-ogsb=\"white\"><strong><span data-ogsc=\"rgb(64, 64, 64)\">Group Information Security Office<br \/>\n<\/span><\/strong><span data-ogsc=\"black\"><a href=\"mailto:security@eng.it\" data-ogsc=\"\" data-outlook-id=\"2ed5ad9d-4e64-47b3-90ec-5589ca13684a\">security@eng.it<\/a><br \/>\n<\/span><strong><span data-ogsc=\"rgb(64, 64, 64)\">Engineering Ingegneria Informatica S.p.A.<br \/>\n<\/span><\/strong><span data-ogsc=\"rgb(64, 64, 64)\">Piazzale dell\u2019Agricoltura, 24 &#8211; 00148 Roma (RM)<br \/>\n<\/span><span data-ogsc=\"black\"><a href=\"http:\/\/www.eng.it\/\" data-ogsc=\"\" data-outlook-id=\"13e3c396-2873-4680-a319-02be2715248d\">www.eng.it<\/a><\/span><\/p>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Dear Colleague, We would like to inform you that the supply chain attack that compromised<span class=\"excerpt-hellip\"> [\u2026]<\/span><\/p>\n","protected":false},"author":4,"featured_media":425,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4],"tags":[],"class_list":["post-424","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-seguranca"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/boasvindas.engdb.com.br\/wp-content\/uploads\/2025\/09\/GHSA-cxm3-wv7p-598c-Nx-Build-System-Supply-Chain-Compromise-3-1024x576-1.webp","_links":{"self":[{"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/posts\/424","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=424"}],"version-history":[{"count":1,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/posts\/424\/revisions"}],"predecessor-version":[{"id":426,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/posts\/424\/revisions\/426"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/media\/425"}],"wp:attachment":[{"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=424"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=424"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=424"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}