Versions 0.7.29, 0.8.0 and 1.0.0 of ua-parser-js were compromised (cryptominer & password stealer). Other versions are not flagged as malicious.
Do not install ua-parser-js 0.7.29, 0.8.0 or 1.0.0
CRITICALanalyst verified
Cryptominer & password stealer, part of the UA-Parser-JS Compromise 2021 campaign. Added to CyberXYZ 2021-10-22, verified by a CyberXYZ analyst.
// what we observed
Compromised maintainer published versions with embedded cryptominer (jsextension binary) and password-stealing malware. 7M+ weekly downloads affected.
// versions and what to do
Malicious
0.7.29, 0.8.0, 1.0.0
Move to
1.0.41 newest 1.x release, no known advisory
0.7.41 newest 0.x release, no known advisory
2.0.10 current release, no known advisory
If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.
A regular expression denial of service (ReDoS) vulnerability has been discovered in ua-parser-js.
// impact:
This vulnerability bypass the library's MAX_LENGTH input limit prevention. By crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to get stuck processing for a very long time which results in a denial of service (DoS) condition.
// affected versions:
From version 0.7.30 to before versions 0.7.33 / 1.0.33.
// patches:
A patch has been released to remove the vulnerable regular expression, update to version 0.7.33 / 1.0.33 or later.