Executive brief
cicada-render is an npm package that contains intentionally malicious code designed to compromise systems. When installed, the package uploads system information to a remote server, downloads executable files, and executes them without user consent. Any computer with this package should be considered fully compromised, and all credentials stored on that system should be immediately rotated from a different machine.
Technical details
This is a deliberate supply-chain attack (CWE-506: Embedded Malicious Code) affecting all versions of the npm package cicada-render. Upon installation, the package performs reconnaissance by uploading system metadata to an attacker-controlled server, then downloads and executes arbitrary code with the privileges of the installing user. No authentication or user interaction is required beyond the initial package installation. The attack vector is network-based and affects anyone who installed or ran this package. No patch exists because the entire package is malicious; complete removal and system remediation are necessary.
Affected products
- npm cicada-render all versions
Timeline
- 2020-09-03: disclosed