Executive brief
cage-js is a JavaScript library distributed via npm. All versions of cage-js contain malicious code that downloads and executes a script from a remote server during package installation. Any system with this package installed should be considered fully compromised, and all credentials stored on that system must be rotated immediately from a different computer.
Technical details
This vulnerability is a malicious package attack (CWE-506). The cage-js npm package contains embedded malicious code in its postinstall script that downloads and executes arbitrary code from an attacker-controlled remote server. The attack vector is network-accessible and requires no user interaction beyond the standard npm install command. All versions of the package (from 0.0.0 onward) are affected. An attacker gains code execution with the privileges of the user installing the package, potentially allowing full system compromise. There is no patch; the entire package should be removed and all credentials regenerated from a clean system.
Affected products
- npm cage-js all versions
Timeline
- 2020-09-03: disclosed