Executive brief
angluar-cli is a Node.js package commonly installed by developers via npm. Version 0.0.3 contains malware designed to exploit typos when installing legitimate packages. When installed, it executes a post-install script that attempts to disable McAfee antivirus and delete related files on macOS systems, leaving developers' machines vulnerable to further attacks.
Technical details
This is a malicious package attack (CWE-506: Embedded Malicious Code) distributed via npm. The attack targets typosquatting: users intending to install "angular-cli" may mistype and install "angluar-cli" instead. Version 0.0.3 contains a malicious post-install script that runs automatically at package installation time without requiring user interaction, targeting macOS systems to terminate and remove McAfee antivirus processes and files. The attack is network-based with no authentication required. An attacker can achieve system compromise and disable security controls, opening the door to secondary malware or data theft. The package should be removed immediately.
Affected products
- npm angluar-cli 0.0.3
Timeline
- 2020-09-11: disclosed