Another npm supply-chain attack

The Socket.dev blog describesthis week's attack on JavaScript packages in the npm repository.

A malicious update to @ctrl/tinycolor (2.2M weeklydownloads) was detected on npm as part of a broader supply chainattack that impacted more than 40 packages spanning multiplemaintainers.

The compromised versions include a function(NpmModule.updatePackage) that downloads a packagetarball, modifies package.json, injects a local script(bundle.js), repacks the archive, and republishes it,enabling automatic trojanization of downstream packages.

There is some more information in thisKrebs on Security article.