[capableweb]

What a worthless advisory, how about sharing who could possibly be affected at the very top, or at least anywhere?

Going to the issue, it seems the `preinstall` field was changed to `start /B node compile.js & node compile.js",` which means this would only run on Windows machines, everyone else seems to be unaffected.

Here is how you can find out if you have the affected package on your machine/instance:

    find ~/projects/ -name "*coa*" | xargs -I {} jq .version {}/package.json 2>/dev/null

Assumes you have `find`, `xargs` and `jq` installed, will print all versions of coa it can find. Seems any version above 2.0.3 is bad.

Edit: is anyone sitting on the source for `compile.js` as mentioned? Would be interesting to see.

[perihelions]

"Bleeping Computer" published screenshots of it (and also has some analysis),

https://www.bleepingcomputer.com/news/security/popular-coa-n...

[d3nj4l]

This should be a top-level comment, if not a post in its own right - it explained the entirety of the situation way better than TFA.

[strogonoff]

That post doesn’t say much about `coa`, besides “new versions started appearing and builds started failing”. The bug report linked from GitHub advisory does a good job of describing the issue, though: https://github.com/veged/coa/issues/99

[d3nj4l]

That's fair, but it describes the change in great detail, and makes it easier to figure out that the primary issue was only on Windows systems.

[isodev]

So if I’m reading this correctly, only Windows hosts are directly affected by the malware. On macOS and Linux one only needs to rollback to a healthy version of the package?

[inbx0]

-name "*coa*" is a bit too eager. It will flag other packages too, like the fairly popular babel-plugin-nullish-coalescing

[resoluteteeth]

If you have an index for the locate command it's probably easier to do:

locate "/coa/package.json" | xargs -I {} jq .version {} 2>/dev/null

[salzig]

maybe print the command (`-t`) xargs executes, to make identification easier.

[resoluteteeth]

It's sort of a moot point since if you have an affected version you have to assume your whole system is compromised anyway in the case of this type of issue.

[vips7L]

On Windows (with powershell):

    gci -r -dir | where name -eq coa | % { gc $_/package.json -EA si | ConvertFrom-Json | select version }