Executive brief
appx-compiler is a Node.js package used by developers for compiling application packages. All versions contain malicious code that exfiltrates system information to remote servers and downloads and executes arbitrary code, giving attackers complete control of affected systems. Any system with this package installed should be considered fully compromised, and all credentials and keys must be rotated immediately from a secure system.
Technical details
This is a supply chain attack via a malicious package published to the npm registry. The vulnerability is classified as CWE-506 (embedded malicious code). All versions of appx-compiler from 0.0.0 onward contain intentionally injected malicious code with no preconditions—simply installing the package triggers the attack. The malicious payload collects system information and transmits it to attacker-controlled servers, then downloads and executes arbitrary files, achieving remote code execution with full system privileges. No patch is available; the package must be completely removed and the development environment rebuilt.
Affected products
- npm appx-compiler all versions
Timeline
- 2020-09-03: disclosed