Executive brief
The an0n-chat-lib npm package was identified as malicious and removed from the npm registry. Any developer or system that installed this package should be considered fully compromised, as the malicious code grants attackers complete control of the affected machine. All credentials, API keys, and secrets stored on compromised systems must be rotated immediately, and the package must be removed—though this may not eliminate all malware introduced by the installation.
Technical details
The an0n-chat-lib package contains malicious code (classified as CWE-506: intentional malicious code) and was actively distributed via the npm package registry before being removed. The attack vector is network-based: developers or build systems fetch and execute this package during installation. No authentication or special preconditions are required—simply installing the package with npm install triggers the malicious payload. An attacker achieves arbitrary code execution with the privileges of the npm installation process, potentially leading to full system compromise. Remediation involves removing the package and rotating all secrets from an unaffected system; however, complete removal of malicious artifacts is not guaranteed.
Affected products
- npm an0n-chat-lib 0.0.0 and later
Timeline
- 2021-01-29: disclosed