Brian Rinaldi (@remotesynthesis.com)

🚨 CrowdStrike has had its NPM packages compromised 𝘔𝘺 𝘣𝘪𝘨 '𝘏𝘈𝘊𝘒𝘌𝘋' 𝘴𝘵𝘢𝘮𝘱 𝘪𝘴 𝘣𝘢𝘤𝘬. Crowdstrike has been caught in a Supply chain attack that so far includes 180 packages from… | Mackenzie Jackson | 47 comments 🚨 CrowdStrike has had its NPM packages compromised 𝘔𝘺 𝘣𝘪𝘨 '𝘏𝘈𝘊𝘒𝘌𝘋' 𝘴𝘵𝘢𝘮𝘱 𝘪𝘴 𝘣𝘢𝘤𝘬. Crowdstrike has been caught in a Supply chain attack that so far includes 180 packages from various organizations. 𝗖𝗿𝗼𝘄𝗱𝘀𝘁𝗿𝗶𝗸𝗲 𝗽𝗮𝗰𝗸𝗮𝗴𝗲𝘀 𝗰𝗼𝗺𝗽𝗿𝗼𝗺𝗶𝘀𝗲𝗱 𝗶𝗻𝗰𝗹𝘂𝗱𝗲 @crowdstrike/commitlint @crowdstrike/falcon-shoelace @crowdstrike/foundry-js @crowdstrike/glide-core @crowdstrike/logscale-dashboard @crowdstrike/logscale-file-editor @crowdstrike/logscale-parser-edit @crowdstrike/logscale-search @crowdstrike/tailwind-toucan-base This appears to be a continuation of the Tinycolor attack first discovered by Daniel Pereira that Socket and StepSecurity had reported on. Both discovered that a combined 40 packages were compromised. Since then, an additional 140 packages have been compromised, including those from Crowdstrike. This is ongoing, so expect more compromises to follow. 𝗪𝗵𝗮𝘁 𝘁𝗵𝗲 𝗺𝗮𝗹𝘄𝗮𝗿𝗲 𝗱𝗼𝗲𝘀 The malware steals credentials using webhook[.]site, this is especially bad because they are using a free-tier webho https://www.linkedin.com/posts/advocatemack_crowdstrike-has-had-its-npm-packages-compromised-activity-7373625746822696960-w8xz