Executive brief
bowee is a Node.js package distributed on npm that contained malicious code in version 1.8.4. When installed, the package executed a preinstall script that downloaded and ran arbitrary code from a remote server, granting an attacker complete control over the affected computer. Any system with this package installed should be considered fully compromised, with all credentials and secrets needing immediate rotation.
Technical details
The vulnerability is a malicious package injection (CWE-506: Embedded Malicious Code). Version 1.8.4 of bowee contained a preinstall script that executed during package installation, downloading an executable from an attacker-controlled remote server and running it with full privileges. The attack vector is network-based and requires no user interaction beyond running npm install; preconditions include the victim installing the compromised version. An attacker gains complete system compromise including code execution, data exfiltration, and persistence mechanisms. The package has been removed from npm; however, full remediation requires rebuilding the system due to the likelihood of additional backdoors.
Affected products
- bowee bowee 1.8.4
Timeline
- 2020-09-02: disclosed
- 2020-09-02: advisory: GitHub advisory GHSA-wgvj-6v57-wjh3 published