Executive brief
1337qq-js is a JavaScript library package distributed via npm. All versions contain malicious code that automatically executes during installation on Unix systems, stealing sensitive information including environment variables, running processes, system configuration files, and npm credentials. Any system with this package installed should be treated as compromised.
Technical details
This is a supply chain attack delivered via a malicious npm package. The vulnerability is classified as malicious code (CWE-506). The attack vector is local/adjacent, triggered automatically through npm install scripts without user interaction. The malicious payload exfiltrates: environment variables, active process listings (ps output), /etc/hosts file contents, system information (uname -a), and npm configuration including credentials. All versions from 0.0.0 onward are affected. No patch is available; the only mitigation is complete package removal and credential rotation.
Affected products
- 1337qq-js contributors 1337qq-js all
Timeline
- 2020-09-04: disclosed