GHSA-g2q5-5433-rhrf: 
JavaScript vulnerability analysis and mitigation

The npm package 'rc', a configuration loader for applications with approximately 14.2 million weekly downloads, was compromised in November 2021. The malicious versions (1.2.9, 1.3.9, and 2.3.9) were published after attackers gained unauthorized access to the package developer's account. This incident was particularly significant as it affected one of npm's most popular packages (The Record, GitHub Advisory).

During installation, the compromised versions executed a suspicious preinstall script that attempted to run compile.js (not present in original versions). The script contained obfuscated JavaScript code that would launch compile.bat, which subsequently downloaded and executed sdd.dll from a malicious domain. The DLL file (SHA256: 26451f7f6fe297adf6738295b1dcc70f7678434ef21d8b6aad5ec00beb8a72cf) was designed to be loaded using regsvr32.exe -s compile.dll (CERT-EU).

The malware was designed to perform various malicious activities including stealing passwords from web browsers, VNC clients, FTP clients, and email accounts. Additionally, it was capable of taking screenshots and logging keystrokes. Any computer that had these compromised packages installed or running was considered fully compromised, requiring immediate rotation of all secrets and keys stored on the affected system (GitHub Advisory).

Users of affected versions were advised to immediately downgrade to version 1.2.8. The npm security team removed all compromised versions from the registry to prevent further infections. Additionally, it was recommended to remove the package entirely from affected systems and rotate all passwords and secrets from a different, uncompromised computer (GitHub Advisory).

The npm team responded quickly to the incident by temporarily disabling the compromised developer account and actively monitoring for similar activity. The compromise was quickly identified due to the package's widespread use and the fact that it hadn't seen new releases since December 2015, which made the sudden new releases suspicious (The Record).