Apifox Supply Chain Poisoning for 18 Days: Fixed but Unannounced Until Exposed

Apifox, an API development collaboration platform, recently suffered a supply chain attack on its public SaaS desktop client. Between March 4 and 22, the event tracking JS file dynamically loaded by the client was tampered with to a malicious version, which could read sensitive files like SSH keys and Git credentials, and report them to a counterfeit domain. The domain is highly deceptive, and attackers could also use it to launch lateral penetration.

Apifox released version v2.8.19 on March 23 to fix the vulnerability by embedding the JS file locally, but no security announcement was made after the fix. It wasn't until March 25, when a security researcher published an analysis, that Apifox issued a belated formal announcement that night.

The incident only affects users of the public SaaS desktop client; the Web version and private deployment version are not affected. Apifox advises developers who used the affected version during the risk period to immediately rotate all sensitive credentials and check for abnormal logins on their servers.