Executive brief
A malicious npm package named arsenic-tabasco-cyborg-peanut-butter was intentionally published to deliver code that compromises computers. When installed, the package downloads and executes a script that gives attackers remote control over the affected system. Any computer with this package installed must be considered fully compromised, and all credentials stored on that machine should be changed immediately from a secure computer.
Technical details
The arsenic-tabasco-cyborg-peanut-butter npm package contains intentional malicious code (CWE-506: Embedded Malicious Code) that executes arbitrary commands during installation. The package automatically downloads and runs a reverse shell script, establishing outbound command-and-control communication that gives an attacker interactive shell access to the system. No authentication or additional user interaction is required beyond the initial installation via npm. An attacker gains complete code execution and system compromise. Full package removal is recommended, though complete remediation cannot be guaranteed without comprehensive system inspection.
Affected products
- npm arsenic-tabasco-cyborg-peanut-butter all versions
Timeline
- 2020-09-03: disclosed