Executive brief
bb-builder is a build tool distributed via npm that contained malicious code in all versions. The package executed a Windows-targeting payload that exfiltrated sensitive information to an attacker-controlled server. Any system with this package installed should be considered fully compromised and all credentials must be rotated immediately from a secure machine.
Technical details
The vulnerability is a malicious package attack (CWE-506) where all versions of bb-builder contained intentionally injected malware. The malicious code executed during package installation or runtime, specifically targeting Windows systems to run an executable and transmit system information to a remote server. No authentication or user interaction is required beyond installing the package from npm. An attacker gains complete control of the host system, with no guarantee that removal of the package will eliminate all compromises. The package was available on the npm registry without safeguards preventing distribution.
Affected products
- npm bb-builder all versions
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory: GitHub security advisory reviewed