Executive brief
boogeyman is a JavaScript library available on npm. A malicious version of this package was published and would automatically steal SSH private keys and npm authentication tokens from compromised developer machines, then exfiltrate them to an attacker-controlled location. Developers who installed this package need to immediately revoke and rotate their credentials.
Technical details
This vulnerability is a supply-chain attack in which a malicious npm package downloads and executes arbitrary code (eval) at install time. The payload retrieves sensitive credentials including SSH keys and .npmrc authentication tokens, then exfiltrates them to a remote pastebin account. The attack requires no user interaction beyond installing the package via npm and affects all versions published. The malicious package was removed from the npm Registry quickly after discovery, but any developer with a local copy must rotate compromised credentials.
Affected products
- npm boogeyman all versions
Timeline
- 2020-09-01: disclosed
- 2020-08-31: advisory: GitHub reviewed advisory