Executive brief
asynnc is a fake npm package designed to trick developers into installing it instead of a legitimate library with a similar name. Once installed, the package silently collects information about the developer's environment (package names, Node version, and whether it ran as administrator) and sends it to a remote server. While no direct system compromise occurs, organizations using this package expose operational details and risk targeted follow-up attacks.
Technical details
This vulnerability involves a typosquatting attack through the npm package manager. The malicious asynnc package contains code that collects system and installation metadata (downloaded package name, intended package name, Node version, sudo status) and exfiltrates it to a remote server. The attack requires no authentication or user interaction beyond the initial package installation—the telemetry is collected and sent automatically. The root cause is insufficient package name validation by developers during installation and lack of registry-level protections against typosquatting. Remediation involves removing the package from all dependencies and using dependency management tools to prevent reintroduction.
Affected products
- npm asynnc all
Timeline
- 2020-09-02: disclosed: Advisory published; malicious package identified and tracked
- 2020-09-02: advisory: GHSA-5fm9-jmv7-fcx5 published