Executive brief
The npm package "bowe" version 1.8.4 was compromised with malicious code that executed during installation. The malicious preinstall script downloaded and executed arbitrary code from a remote server, giving attackers full control of the affected system. Any computer with this package installed should be considered completely compromised, with all credentials and secrets rotated immediately from a clean machine.
Technical details
The vulnerability is a supply-chain compromise where a malicious actor injected arbitrary code into the bowe npm package version 1.8.4. The malicious payload was embedded as a preinstall script that executes automatically during package installation without requiring user interaction or special privileges. The script downloads and executes additional code from an attacker-controlled remote server, establishing a backdoor and granting the attacker complete control over the compromised system. This attack vector requires only that a developer install the compromised package version, making it a critical supply-chain risk. No patch is available; the package should be removed entirely and the system treated as fully compromised.
Affected products
- npm bowe 1.8.4
Timeline
- 2020-09-02: disclosed