Poisoned Pipeline / Incidents / AS234

AS234 · 2018-05

getcookies backdoor reached mailparser dependency chain

npm

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

• T0172 Runtime backdoor
• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://blog.npmjs.org/post/173526807575/reported-malicious-module-getcookies
• https://thenewstack.io/npm-attackers-sneak-a-backdoor-into-node-js-deployments-through-dependencies/
• https://www.theregister.com/security/2018/05/05/cookie-code-compromise-caper-caught-and-crumbled/357957
• https://news.ycombinator.com/item?id=16975025
• https://dl.acm.org/doi/pdf/10.1145/3510457.3513044