Executive brief
A malicious NPM package named "chak" was designed to typosquat a popular package of similar name. When installed, it secretly collected and transmitted user information to a remote server, including the package names involved, Node version, and whether the process had elevated privileges. This represents a supply chain attack vector where users installing a misspelled package name inadvertently run attacker-controlled code on their systems.
Technical details
This is a malicious package attack (CWE-506: Embedded Malicious Code). The "chak" package typosquatted a legitimate package of similar name, exploiting common typos during package installation. Upon installation via npm, the package executed code that exfiltrated system information (package names, Node version, sudo status) to a remote attacker-controlled server. No CVE exists; the attack was discovered and the malicious package removed from npm. The attack vector is network-accessible (users installing from npm registry) with no authentication or user interaction required beyond the installation command itself. The recommended mitigation is package removal and careful verification of package names before installation.
Affected products
- npm chak all versions
Timeline
- 2020-09-02: disclosed