Mitigation
Unfortunately, enterprise security teams must perform full audits of developer machines. The compromised packages are transient dependencies for thousands of others and if any of the poisoned versions were installed during the attack window, all possible credentials accessible on that machine, or other machines accessible from that machine, need to be rotated.
“Rotate, at minimum: npm automation tokens, GitHub personal access tokens and SSH keys, cloud provider credentials (~/.aws, ~/.config/gcloud, Azure), Kubernetes service accounts, and any secrets in environment variables or .env files present at install time,” the StepSecurity researchers said. “Maintainers of npm packages should treat their publish credentials as exposed. The second wave of this campaign demonstrates exactly why: additional maintainer accounts published the identical payload within the same hour.”
The StepSecurity report includes indicators of compromise, a list of infected packages, as well as defense-in-depth recommendations for developer machines and processes that could have stopped this compromise.
