Executive brief
The asinc npm package is a malicious typosquat targeting developers who mistyped a legitimate package name during installation. Once installed, the package silently collects and transmits information about the developer's environment (machine name, Node.js version, sudo privileges) to a remote server without consent, creating a foothold for further compromise and potential credential theft.
Technical details
This is a supply-chain attack via typosquatting (CWE-506). The malicious asinc package deliberately mimics the name of a legitimate, popular npm package to trick developers into installing it through simple typos. Upon installation, the package exfiltrates metadata including the package name, intended package name, Node version, and whether the process runs with sudo privileges to an attacker-controlled server. No further code execution or compromise is documented, but the reconnaissance data enables targeted follow-up attacks. The attack vector is network-based (the package must be downloaded and executed in a developer environment), requires no authentication, and affected all versions of the asinc package.
Affected products
- asinc asinc all versions
Timeline
- 2020-09-02: disclosed