Tinycolor supply chain attack post-mortem
5 hours ago
- #npm Security
- #Supply Chain Attack
- #GitHub Actions
- A malicious GitHub Actions workflow was pushed to a shared repository (angulartics2), exfiltrating an npm token with broad publish rights.
- The attacker used the stolen npm token to publish malicious versions of 20 packages, including @ctrl/tinycolor, which is downloaded about 2 million times a week.
- GitHub and npm security teams quickly responded by unpublishing the malicious versions, and clean versions were released to flush caches.
- The attack did not involve phishing, direct compromise of the GitHub account, or malicious packages installed on the author's machine.
- The author plans to move to npm’s Trusted Publishing (OIDC) to eliminate static tokens and enforce stricter controls on publishing.
- Current measures include requiring 2FA for publishing, revoking all tokens, and using pnpm to prevent unapproved postinstall scripts.
- The author suggests improvements like a single toggle for Trusted Publishing, first-class semantic-release support with OIDC, and better visibility for postinstall scripts on npm.
- Thanks were given to Wes Todd, the OpenJS Foundation, and GitHub/npm security teams for their rapid response.