Executive brief
bignum is a Node.js library for handling large numbers. Versions 0.12.2 through 0.13.0 downloaded pre-compiled binaries from an AWS S3 bucket that expired and was subsequently taken over by a malicious actor. Users who installed these affected versions received malware capable of exfiltrating data from their computers, potentially compromising sensitive information and system security.
Technical details
The vulnerability is classified as embedded malicious code (CWE-506). bignum used the node-pre-gyp tool to optionally download pre-built binary versions of its native addon from an S3 bucket. When the S3 bucket expired, a malicious third party registered and claimed it, then began serving binaries containing data-exfiltrating malware. This affects versions 0.12.2 to 0.13.0 inclusive. The attack vector is network-based and automatic—no user authentication or interaction is required beyond installing the affected package. Version 0.13.1 removes node-pre-gyp entirely and does not download pre-built binaries, resolving the issue.
Affected products
- npm bignum 0.12.2 to 0.13.0 (inclusive)
Timeline
- 2023-05-24: disclosed