Executive brief
The aasync npm package was a typosquatting attack targeting developers who mistyped the name of a popular package. Once installed, the malicious package tracked and reported user information—including the incorrect package name, intended package name, Node version, and sudo status—to a remote server. This represents a supply chain attack that collects telemetry on developers' systems without consent.
Technical details
The vulnerability is a malicious npm package (CWE-506: Embedded Malicious Code) that exploits typosquatting to trick developers into installing it instead of a legitimate package. The attack vector is network-based, requiring only that a developer misspell the package name during installation; no authentication or user interaction beyond the installation command is needed. Upon installation, the package exfiltrates metadata about the developer's environment and installation intent to an attacker-controlled server. The package has been removed from npm; mitigation involves verifying package names before installation and removing any installed version.
Affected products
- npm aasync all versions
Timeline
- 2020-09-02: disclosed