Supply Chain Attack: Compromised d3-color package (URGENT)
SUPPLY CHAIN SECURITY INCIDENT
Incident Summary
- Package: d3-color@3.1.0
- Severity: CRITICAL (CVSS 10.0)
- Type: Supply Chain Attack / Malware
- Status: CONFIRMED COMPROMISED
What Happened
The d3-color npm package was compromised. Attackers published malicious code containing cryptocurrency miner and data exfiltration.
Our Exposure
We installed d3-color@3.1.0 on 2025-10-09 AFTER the compromise.
Data at Risk
- ML model metrics
- User analytics
- API keys
- Customer data
Actions Required
- Downgrade to d3-color@3.0.1
- Rotate all secrets
- Audit firewall logs
- File incident report