Executive brief
The asymc npm package was a typosquatting attack designed to deceive developers into installing it instead of a legitimate package with a similar name. Once installed, the package collected and transmitted sensitive installation metadata to a remote server, including the Node.js version, whether it was running with elevated privileges, and details about the intended vs. installed package names. This represents a supply chain compromise affecting any developer who accidentally installed the wrong package.
Technical details
The vulnerability is a malicious package (CWE-506: embedded malicious code) published to npm under the name "asymc" that performs typosquatting against a legitimate package of similar name. The package's post-install or initialization code exfiltrates system and installation metadata to a remote command-and-control server without user consent or awareness. Attack vector is network-based: installation occurs when a developer makes a typo during package installation (npm install asymc instead of the intended package). No authentication is required; the malicious code executes automatically upon package installation. The only remediation is manual removal of the package from dependencies and reinstallation of the correct package. The malicious package has been removed from npm; no patch exists as the entire package was the attack vector.
Affected products
- npm asymc all versions
Timeline
- 2020-09-02: disclosed: Malicious package discovered and advisory published