Executive brief
blubird is a popular npm package for promise-based async operations. Version 3.5.0 contains malicious code that executes a cryptocurrency miner (coin-hive) when the package is loaded, exploiting developers who mistype the module name during installation. An attacker can gain arbitrary code execution and consume system resources for unauthorized mining.
Technical details
This vulnerability involves deliberate injection of malicious code (CWE-506) into version 3.5.0 of the blubird npm package. The package is a typosquatting attack targeting users who accidentally type "blubird" instead of the legitimate "bluebird" module. Upon require(), the malicious code executes a coin-hive cryptocurrency miner in the background. Attack vector is network-based (npm install), requiring no authentication or user interaction beyond installation of the package. An attacker achieves arbitrary code execution with full privileges of the Node.js process, enabling resource hijacking and system compromise. The vulnerability was addressed by removal of the malicious version from npm.
Affected products
- npm blubird 3.5.0
Timeline
- 2020-09-11: disclosed