Executive brief
The asyync npm package is a malicious typosquat designed to trick developers into installing it instead of the legitimate package it mimics. Once installed, it silently collects and transmits sensitive environment information to a remote server, including the intended package name, Node version, and sudo status—creating a supply-chain attack vector that could enable credential theft or system compromise.
Technical details
This is a malicious package supply-chain attack (CWE-506). The asyync package employed typosquatting—registering a name similar to a popular legitimate package—to deceive developers during installation. The package contained code that exfiltrates metadata about the installation environment to an attacker-controlled server, including the package name requested, the actual package name installed (asyync), Node version, and whether the process had elevated privileges. Attack vector is network-based and requires only that a developer mistype a package name during npm installation with no authentication or special preconditions. The damage is limited to information disclosure rather than direct code execution, though the metadata could enable targeted follow-up attacks.
Affected products
- npm asyync all versions
Timeline
- 2020-09-02: disclosed: Advisory GHSA-rm7c-x424-g2mw published
- 2020-08-31: other: GitHub review completed