Poisoned Pipeline / Incidents / AS11
ua-parser-js npm account takeover
In October 2021 the npm account of the ua-parser-js maintainer was
compromised. Three versions of the widely used user-agent parser were
published with malware that installed a cryptominer and a password
stealer (depending on OS). GitHub/npm yanked the versions within hours.
This is account-takeover → malicious publish, a pattern repeated in later
npm incidents (Qix/chalk, 2025).
Mapped techniques
- T0113 Compromised user account
- T0109 Publish malicious artifact
- T0121 Compromised legitimate artifact
- T0151 Installation scripts
- T0139 Resource hijacking
supply-chain ua-parser-js on npm
The maintainer npm account was taken over; MFA on publishing was not
in place at the time.
Versions 0.7.29, 0.8.0, and 1.0.0 were published with a preinstall payload.
Consumers pulling the same well-known package name received malware.
post-supply-chain Downstream applications
A preinstall script fetched and ran OS-specific binaries.
Linux/macOS victims ran a cryptominer; Windows victims received a stealer.
Framework gaps noted
- Registry-enforced 2FA for high-impact maintainers is a mitigation (M1530) that this incident showed was not universally applied.