Malicious Update to Popular NPM Package TinyColor Exposes Software Supply Chains

The Socket Research Team has uncovered a large-scale supply chain attack on the npm ecosystem, with more than 40 packages trojanized, led by the prominent @ctrl/tinycolor library, which has over 2.2 million weekly downloads. According to the Socket Research Team, a malicious update to @ctrl/tinycolor was detected on npm as part of a broader supply chain attack that impacted more than 40 packages spanning multiple maintainers.

The compromised versions introduced a rogue function named NpmModule[.]updatePackage, which downloads a package tarball, modifies package.json, injects a local script (bundle.js), repacks the archive and republishes it, enabling automatic trojanization of downstream packages.

The injected bundle.js script used TruffleHog to hunt for sensitive credentials, downloading and executing the tool to search the host for tokens and cloud credentials, then creating a GitHub Actions workflow inside repositories and exfiltrating results to a hardcoded webhook. Key targets included GitHub tokens, npm tokens, AWS credentials and GCP metadata endpoints, with persistence ensured as future CI runs could trigger the exfiltration step from within the pipeline.

Dozens of other packages were affected, including angulartics2, @ctrl/deluge, @ctrl/qbittorrent, koa2-swagger-ui, @nativescript-community/ui-image, ngx-toastr and ts-gaussian.