After seeing the suggested attack vector, we set out to understand how many packages are actually vulnerable in NPM, by using the NPM APIs to retrieve the relevant data.
Our results were as follows –
3210 unique packages have at least one maintainer with an available-to-purchase domain, in their latest published version
This is ~0.16% of all npm packages (as reported by modulecounts)
Out of these, 393 packages are administered by multiple maintainers while 2817 are administered by a single maintainer
These are only the directly (potentially) vulnerable packages. These numbers do not include packages which depend on one of the potentially vulnerable packages
There are even more packages with expired domains, which currently cannot be purchased, since the domain is currently pending delete or in a remediation period
900 maintainers were found to have an available-to-purchase email domain
This is ~0.17% of all registered npm maintainers
The top package that is potentially vulnerable to this attack has a total download count of ~31M downloads (~670k weekly downloads) as reported by npm