Executive brief
body-parse-xml is a Node.js package used to parse XML data in web applications. A malicious version of this package was published to npm, containing code that stole system information (OS details, hostname) and sent it to an attacker-controlled server. Applications using this compromised package inadvertently exposed sensitive infrastructure details to attackers.
Technical details
This vulnerability is a supply-chain attack involving a malicious package published to the npm registry (CWE-506: Embedded Malicious Code). The body-parse-xml package versions from its introduction contained embedded code that exfiltrated system metadata (operating system type, hostname) to a remote server without user consent or knowledge. The attack vector is network-based and requires no user interaction beyond installing the compromised package version. An attacker who successfully published this code could gather reconnaissance data on all systems using the affected package. The remediation is immediate removal of the package from affected environments.
Affected products
- npm body-parse-xml all published versions
Timeline
- 2020-09-03: disclosed