The NCSC warns developers about recent supply chain attacks in which malicious versions of packages have been distributed. Both compromised npm packages and Python libraries can be abused in this way to gain access to development environments and other IT systems. If your team builds software using third-party dependencies, it’s worth checking now and intervening where needed.
This alert includes several concrete examples, including an attack targeting a security scanner (Trivy) and a compromise of the popular HTTP library axios. The core mechanism is always the same: attackers add malware to legitimate packages, which then get rolled out as updates.
What happened in the attacks?
npm is a package manager for Node.js, used to develop software with external libraries. In parallel, there are similar ecosystems for Python through PyPI. In recent campaigns, packages were not only affected, but actually compromised, giving attackers control over installations and updates within your organization.
With this approach, attackers often do not target an end user, but rather the development process. Once a compromised package is installed, the malware can behave as part of the build or deployment chain. This creates new entry points to authentication credentials and then to other environments.
Examples from the alert: Trivy and axios
One of the incidents described dates from March 19. The attackers gained unauthorized access to the development environment of Trivy, a security scanner used in contexts including Node.js applications. Then, a malicious version was distributed that can provide access to sensitive authentication credentials. In addition, so-called backdoors were placed to allow remote command execution on compromised systems.
According to the description, that access was then used to carry out further infections via additional packages. After the initial compromise, in any case multiple npm packages were affected (the true number is likely higher). Python packages are also mentioned that would have been compromised using a similar method.
Separately, on March 30, it came to light that axios was also compromised on npm. Axios is a widely used library for communicating via HTTP. In this supply chain attack as well, malware was added to a legitimate package, after which distribution occurred as an update to the package.
What is the risk for your organization?
The risk arises when your software uses a dependency that has since been compromised. In that case, attackers can steal authentication credentials. With those credentials, they can then attempt to gain access to other (development) environments or systems within your network.
In addition, the NCSC points out that the obtained access may be used to exfiltrate (sensitive) data from systems. The alert mentions scenarios such as extortion: publishing data on the internet if you don’t pay. Another option is selling stolen data to other cybercriminals, who then reuse the credentials for follow-up attacks.
Check: has your development environment been affected?
The NCSC advises you to first determine whether your development environment shows indicators of compromise. Concretely, you should check for the presence of two groups of packages:
- Trivy: version 0.69.4
- axios: versions 1.14.1 and 0.30.4
Note: even if you don’t use these packages, a compromise could still have entered your environment through another package. That’s why it’s important to also look for indicators-of-compromise (IOCs). Multiple security companies have shared IOCs, and their presence may indicate a possible compromise.
What you need to do immediately if there are indications
If you find anything that matches a compromise, don’t wait. The alert lists three practical steps.
1) Set up your incident response process
Start with your IR process to investigate scope and impact. Consider enlisting a specialized incident response service provider if you need quick clarity on reach, timeline, and potential data leaks.
2) Rotate all potentially affected credentials
The NCSC recommends rotating tokens, credentials, and other authentication data that attackers may have had access to. This reduces the chance that stolen access is still usable.
3) Notify customers if necessary
If your software affects end users or customers, it may be necessary to inform them in a timely manner. That way, they can take appropriate measures in their own environment.
Prevention: how to make supply chain attacks less likely
In addition to responding reactively, prevention is essential. The alert lists a set of measures you can combine in your development and CI/CD processes.
- Use version pinning: pin hashes of external libraries (where possible) instead of only using version numbers. This reduces the likelihood that you download a tampered variant.
- Update carefully: apply a dependency cooldown period. Roll out critical security updates quickly, but wait a few days with regular dependency updates when that’s feasible.
- Disable post-install scripts: for example via –ignore-scripts with npm ci.
- Detect early in CI/CD: use scanning tools in your build and deployment chain to recognize malicious updates and packages.
- Use only trusted publishers: limit yourself to packages from reliable parties and regularly check with npm audit.
- Replace long-lived tokens: implement npm Trusted Publishing with OpenID Connect (OIDC) instead of a static NPM_TOKEN. This makes authentication easier to manage and makes misuse of a long-lived publish token less likely.
Conclusion
The NCSC warning shows that compromised npm packages and Python libraries can not only disrupt your builds, but also lead to access to authentication credentials and possibly sensitive data. By checking purposefully now, responding quickly when there are indications, and hardening your supply chain with version pinning, safer installation practices, and CI/CD detection, you significantly reduce the risk.
Source: https://www.ncsc.nl/alerts/ontwikkelaars-opgelet-gecompromitteerde-npm-en-python-packages
