Executive brief
alipayjsapi is an npm package that provides Alipay JavaScript API integration. All versions contain malicious code that exfiltrates system information and downloads/executes arbitrary files, giving attackers complete control over infected systems. Any system with this package installed must be considered fully compromised and rebuilt from scratch.
Technical details
This is a deliberately malicious npm package (CWE-506: Embedded Malicious Code) affecting all versions from 0.0.0 onward. The package contains code that unconditionally exfiltrates system information to a remote server, then downloads and executes arbitrary payloads, resulting in complete remote code execution with no authentication or user interaction required. The attack is network-accessible and cannot be mitigated by simply removing the package, as the downloaded malware may establish persistent foothold mechanisms. All credentials, keys, and secrets accessible from compromised systems must be rotated from unaffected systems.
Affected products
- npm alipayjsapi all versions
Timeline
- 2020-09-03: disclosed: Vulnerability published in GitHub Advisory Database