Executive brief
The anarchy npm package contains intentionally malicious code that executes a destructive command during installation. When installed, the package runs a command that deletes critical system files, rendering the affected system inoperable. Any system that has installed this package is at risk of complete data loss and operational failure.
Technical details
The anarchy npm package contains intentionally injected malicious code (CWE-506: Embedded Malicious Code) that executes during the package installation phase. The install script runs a destructive command (rm -rf /) that attempts to recursively delete all files from the system root directory. The attack is network-reachable and requires no authentication or user interaction beyond installing the package via npm. An attacker who installs this package—either directly or as a transitive dependency—will trigger immediate and severe system compromise, including data destruction and loss of system availability. All versions of the package are affected; removal is the only mitigation.
Affected products
- npm anarchy all versions
Timeline
- 2020-09-03: disclosed
- 2020-09-03: published: advisory published on OSV database