Executive brief
The alico npm package contains malicious code that exfiltrates system information, downloads remote payloads, and executes arbitrary code on infected systems. Any computer with this package installed should be considered fully compromised, with all credentials and encryption keys immediately rotated from a different device.
Technical details
The vulnerability is classified as malicious code (CWE-506) in all versions of the alico npm package. The package performs reconnaissance by uploading system information to attacker-controlled servers, fetches executable payloads, and executes them with the privileges of the Node.js process. No authentication or user interaction is required; installation alone triggers the malicious behavior. An attacker gains complete code execution and persistence capabilities on the affected system.
Affected products
- npm alico all versions
Timeline
- 2020-09-03: disclosed