Summary
On 22 October 2021, attackers hijacked the npm account of the developer behind ua-parser-js, a small library downloaded 6 to 8 million times a week, and published versions that installed a cryptominer and a password-stealing trojan on every machine that updated. The malicious versions were live for only about four hours, but a library that popular reaches an enormous blast radius fast, because it is bundled, transitively, into a huge slice of the JavaScript world. It is a textbook reminder that the security of your app is the security of every maintainer in your dependency tree, including the small, single-author ones.
How it happened
ua-parser-js does something unglamorous and ubiquitous: it reads browser user-agent strings, and it was maintained by one person. Attackers compromised that maintainer's npm account, an account takeover through stolen credentials, and used it to publish three malicious versions (0.7.29, 0.8.0, and 1.0.0).
Each one carried a preinstall script, code that npm runs automatically during npm install. That script dropped binaries that ran an XMRig cryptominer on Linux and Windows and a password-stealing trojan (a DanaBot variant) on Windows. In other words, simply installing or updating the dependency was enough to run the backdoor; no other action was required. It is a supply-chain attack through a hijacked maintainer account, a close cousin of the event-stream takeover, but achieved by stealing the account rather than being handed it.
The damage
The malicious versions were live for about four hours. That sounds brief, but ua-parser-js is a transitive dependency of countless projects, so anyone who happened to run npm install on an affected project during that window was compromised. The guidance was unambiguous: update to the clean versions and treat any affected Windows machine as fully compromised, rotating every credential on it, because a password-stealer ran (Linux hosts ran only the XMRig miner, which even skipped machines it geolocated to Russia, Ukraine, Belarus, or Kazakhstan). The maintainer himself was a victim of the account takeover, and noticed it only when his inbox was suddenly flooded with signup spam; the incident became one of npm's strongest arguments for mandatory two-factor authentication.
Why ua-parser still matters
ua-parser is the maintainer-account-takeover lesson. A single developer's npm credentials are a skeleton key to millions of machines, and install scripts (preinstall and postinstall) run arbitrary code on every npm install, a giant and under-appreciated attack surface. The defences are concrete: require two-factor authentication on every npm maintainer and publisher account, the direct fix here; pin dependencies with a lockfile and review updates rather than auto-pulling the latest; run installs with scripts disabled where feasible, and in CI use isolated, least-privilege build environments so a malicious install script cannot reach your secrets; and monitor for unexpected new releases of the packages you depend on.
How to fix it
- Pin to or upgrade past the clean versions (0.7.30, 0.8.1, 1.0.1) and rebuild from a clean lockfile.
- Treat any Windows machine that installed a malicious version as fully compromised and rotate every credential it held, since a password-stealer ran; rebuild Linux hosts that ran the miner.
- Audit install (preinstall and postinstall) scripts across your dependency tree and disable them where you can.
How to avoid it
- Require 2FA on every npm maintainer and publisher account; account takeover was the entire attack.
- Pin dependencies with a lockfile and review updates rather than auto-pulling the latest; a popular transitive package can be poisoned for hours before anyone notices.
- Run installs with scripts disabled where feasible, and use isolated, least-privilege CI build environments so a malicious install script cannot reach your secrets.
- Monitor for unexpected new releases of your critical dependencies and pull from a vetted internal registry mirror.
References
- https://www.rapid7.com/blog/post/2021/10/25/npm-library-ua-parser-js-hijacked-what-you-need-to-know/
- https://github.com/faisalman/ua-parser-js/issues/536
- https://www.cisa.gov/news-events/alerts/2021/10/22/malware-discovered-popular-npm-package-ua-parser-js
- https://therecord.media/malware-found-in-npm-package-with-millions-of-weekly-downloads
Related vulnerabilities
All Supply chain →- CRITICALGHSA-93qj-5q5v-3c2h
Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
- CRITICALNPM-REDHAT-MIASMA-2026
In June 2026 the npm supply-chain worm finally produced something genuinely new and frightening: malicious packages that were signed and carried valid build provenance. Attackers used a compromised GitHub account inside Red Hat's own organisation to publish trojanised versions of 31 packages in the @redhat-cloud-services namespace through Red Hat's legitimate CI pipeline, so the poisoned releases arrived with authentic attestations proving they were built by the real build system. The payload, nicknamed Miasma, was a lightly re-skinned copy of Mini Shai-Hulud, a worm that a group called TeamPCP had open-sourced for anyone to reuse weeks earlier. No Red Hat customers were harmed, because Red Hat strips install scripts before deployment, but the permanent lesson is uncomfortable: a signature proves where a package was built, not that the build was clean.
- CRITICALNPM-AXIOS-2026
On 31 March 2026 the single most widely used HTTP client in the JavaScript world was turned into malware for about three hours. Axios carries well over 100 million weekly downloads and sits as a transitive dependency underneath a huge share of the npm ecosystem, so when a North Korea-nexus actor took over the maintainer's account and published two booby-trapped versions, the blast radius was enormous even though the bad versions were live only for one early-morning window. The poisoned releases pulled in a hidden dependency that ran on install and dropped a cross-platform remote access trojan onto developer machines and CI runners. It is the case study in why a few hours of a popular package being compromised is still a global incident, and in why a maintainer's own laptop is now a nation-state target.
- HIGHSC-NOTEPADPP-CHRYSALIS-2025
In 2025, a Chinese state-linked espionage group hijacked the update channel of Notepad++, one of the most widely installed Windows text editors, to plant a custom backdoor on a handful of carefully chosen targets. The attackers never touched Notepad++'s source code or its signing keys. Instead they compromised the third-party shared-hosting server that delivered updates, and abused the fact that the WinGUp updater shipped without any integrity check on what it downloaded (tracked as CVE-2025-15556). For machines on their target list, WinGUp was silently redirected to attacker-controlled servers that served a trojanized installer; everyone else kept receiving the genuine update. The campaign ran from roughly June to December 2025 and was only made public in February 2026 by Rapid7, with Kaspersky and Broadcom/Symantec corroborating it independently.
- HIGHSC-ESCAN-RELOAD-2026
On or around January 20, 2026, attackers who had broken into a regional update server for eScan, the antivirus product made by India's MicroWorld Technologies, pushed a trojanized Reload.exe through the legitimate update channel during a window of roughly two hours. The security software itself became the delivery vehicle for malware. The malicious binary carried eScan's code-signing identity, but its signature was actually invalid; it ran anyway because the updater trusted the channel rather than rigorously validating the signature. Once on a host, the malware rewrote the Windows HOSTS file to cut eScan off from its own update servers, blinded script scanning, and reached out to takedown-resistant command-and-control hosted on blockchain naming systems. Morphisec disclosed the campaign, with Kaspersky and Darktrace corroborating it independently.
- CRITICALNPM-SHAI-HULUD-2-2025
Shai-Hulud is the nightmare the npm ecosystem had long feared: a self-replicating worm. First seen in September 2025 and back in a more aggressive wave around 21-24 November 2025 ("The Second Coming"), it does not just poison one package and wait. When its malware runs in a developer's environment, it harvests every secret it can find, npm tokens, GitHub tokens, cloud keys, then uses those stolen npm tokens to automatically publish itself into other packages the victim maintains, spreading from maintainer to maintainer on its own. The second wave hit more than 25,000 GitHub repositories across roughly 500 compromised accounts, leaked the stolen secrets into public repos, and, if it failed to steal credentials, tried to wipe the victim's home directory. It is the moment supply-chain malware learned to propagate like a biological infection.