Poisoned Pipeline / Incidents / AS46
eslint-scope and eslint-config-eslint malicious publishes
On 12 July 2018 the npm accounts for eslint-scope and eslint-config-eslint
were compromised and malicious versions published. A postinstall script
harvested npm credentials from the developer machine and sent them to
an attacker server. ESLint’s official postmortem is the primary record.
This is the classic “popular linter as credential harvester” case that
the inherited corpus never documented.
Mapped techniques
- T0113 Compromised user account
- T0109 Publish malicious artifact
- T0151 Installation scripts
- T0140 Harvest tokens from environment variables
- T0121 Compromised legitimate artifact
supply-chain eslint-scope on npm
Maintainer npm accounts for eslint-scope / eslint-config-eslint taken over.
Malicious versions published under the real package names.
postinstall harvested the local npm token.
npm credentials stolen from the installing developer.
Consumers of the real eslint-scope name received the harvester.