Executive brief
Version 16.3.3 of the browserift npm package contained malicious code that executes during installation as a preinstall script. Once installed, the package opens a connection to a remote server and executes arbitrary commands, giving an attacker complete control over the affected system on both Unix and Windows platforms. Any machine with this package installed should be considered fully compromised, with all credentials and secrets rotated from a different device.
Technical details
This vulnerability is a malicious package attack (CWE-506) in the npm ecosystem. Version 16.3.3 of browserift contained a backdoor implemented as a preinstall script that executes automatically when the package is installed via npm. The script establishes a reverse connection to an attacker-controlled remote server and awaits commands, which are then executed with the privileges of the user performing the installation. No authentication or user interaction is required beyond running a standard npm install command. The attack vector is network-based and affects both Unix and Windows systems. The impact is complete system compromise, including data exfiltration, credential theft, and lateral movement capability. Removal of the package does not guarantee removal of all malicious artifacts, as the attacker may have already deployed additional persistence mechanisms during the initial compromise.
Affected products
- npm browserift 16.3.3
Timeline
- 2020-09-02: disclosed: Vulnerability disclosed on GitHub Advisory Database
- 2020-08-31: other: GitHub reviewed advisory