ua-parser-js (2021): An npm Account Takeover With Millions of Weekly Downloads
Summary
In October 2021, three versions of the npm package ua-parser-js were published containing malicious code. The package, which parses browser user-agent strings, had millions of weekly downloads and appeared as a transitive dependency in a very large number of projects. The maintainer confirmed that an attacker had gained access to his npm account and published the versions without his knowledge.
Technical Root Cause
This was an account compromise rather than a code vulnerability. With publishing rights obtained, the attacker released versions whose install scripts ran on npm install, deploying a cryptocurrency miner and, on Windows, credential-stealing malware. Because npm lifecycle scripts execute automatically during installation, simply installing or building a project that resolved to an affected version was enough to run the payload.
This maps to CWE-506 (Embedded Malicious Code), with the install-script execution behaviour as the delivery mechanism.
Why It Mattered
The affected versions were live for a matter of hours, but the download volume in that window was substantial, and the impact extended to anyone whose CI pipeline happened to resolve a fresh install during it. CISA issued an advisory recommending that affected users treat systems as fully compromised and rotate credentials, which is a strong recommendation reflecting the credential-theft payload.
Alongside event-stream (a maintainer handoff) and XZ Utils (a long social-engineering campaign), this completes a set of three distinct routes to the same outcome: legitimate publishing rights in the wrong hands. None of the three involved exploiting a vulnerability in the package itself.
OWASP / CWE Mapping
- CWE-506: Embedded Malicious Code
- OWASP A08:2021: Software and Data Integrity Failures
Lasting Impact
The incident contributed to npm's subsequent enforcement of two-factor authentication for maintainers of high-traffic packages, and is a standard argument for lockfiles with integrity hashes, for disabling install scripts where feasible, and for treating a short publication window as sufficient exposure to warrant investigation rather than dismissal.
How Safeguard Helps
Malware detection across package ecosystems is aimed at exactly this case, where the package version is current and carries no CVE but the published artifact is malicious. Version-matching against a vulnerability database alone would not flag it.
