CISA warns of malware discovered in npm package UAParser.js, which has 6M-7M downloads weekly, that installs a password stealer and a crypto miner
A massively popular JavaScript library (npm package) was hacked today and modified with malicious code that downloaded and installed … Source: GitHub , CISA , and GitHub .
The RecordCatalin Cimpanu
Context & Ripple Effects
The UAParser.js compromise is an early example of a dependency attack reaching applications through a widely used npm package: malicious code delivered both credential theft and cryptomining payloads. Later coverage shows the exposure widening from a compromised Axios release with a malicious dependency to campaigns publishing hundreds of malicious npm versions.
The arc matters because package popularity multiplies a single maintainer or release-security failure across downstream users. The subsequent ChainDrop campaign affecting more than 1,300 packages shows how supply-chain compromises can move beyond isolated packages into broad ecosystem contamination.
First-order effects
Teams whose builds pulled the compromised UAParser.js version face immediate exposure to password theft and unauthorized cryptomining through an otherwise routine JavaScript dependency.
CISA's warning makes the package compromise a remediation issue for organizations relying on npm dependencies, rather than a problem confined to UAParser.js's publisher.
Second-order effects
GitHub and npm-package maintainers face stronger pressure to protect publishing accounts and release pipelines, as later attackers compromised a maintainer account to inject malware across 18 npm packages.
Software buyers and security teams must treat dependency updates as a source of operational risk, especially after the Axios incident showed that a high-download client library can carry a malicious dependency in particular releases.
Third-order effects
Repeated compromises point toward software supply-chain security becoming a release-governance problem: the integrity of maintainer accounts, package versions, and transitive dependencies matters alongside application code.
If campaigns such as Shai-Hulud continue to publish malicious versions at scale, npm ecosystem trust will increasingly depend on automated provenance and dependency verification rather than package popularity alone.
The trend: Open-source software supply-chain attacks are shifting from isolated package tampering toward scalable campaigns that exploit the trust relationship between maintainers, registries, and downstream builds.
NEW: CISA warned today about the compromise of a major JavaScript/npm library with millions of weekly downloads -The library, called UAParser.js, was compromised with a cryptominer -Library author said their account was hijacked https://therecord.media/... https://twitter.com/...
Versions (0.7.29, 0.8.0, and 1.0.0 ) of a popular NPM package named ua-parser-js was found to contain malicious code. Please update to the patched versions (0.7.30, 0.8.1, 1.0.1). More in our alert: https://us-cert.cisa.gov/... GitHub advisory: https://github.com/...
I feel like NPM revolutionized software development for the web and now has the potential to destroy software development for the web https://twitter.com/... https://twitter.com/...
Important @CISAgov alert: Malware inserted into widely used JavaScript library (npm package) AParser.js which reads information stored inside user-agent strings. Developers must update to patched versions: 0.7.30, 0.8.1, 1.0.1 https://therecord.media/...
Beware: compromised versions of #npm package ua-parser-js. Malicious versions have been deprecated and flagged. Details: https://github.com/... Take steps to handle your dependencies securely. #node #javascript #nodejs #supplychainsecurity
Another (IMO) supply chain compromise - this time with a popular JS library ua-parser-js. 2.5m public repos on GH, 7m weekly downloads on NPM. Oof. https://github.com/...
Popular npm package ‘ua-parser-js’ has been compromised. The preinstall-code added to the compromised artifacts has not been obfuscated. https://github.com/... #supplychainsecurity https://twitter.com/...