Executive brief
colour-string is a popular JavaScript library for color parsing and manipulation. Version 1.5.3 of this package contained malicious code embedded in an installation script that executed arbitrary code and installed a backdoor on affected systems. Any system with this version installed should be considered fully compromised, and all secrets and credentials should be rotated from a clean device.
Technical details
This vulnerability is a supply chain attack (malicious package injection) involving embedded code execution in npm preinstall scripts. The malicious payload downloads and executes a file from a remote server, establishing unauthorized access (backdoor) to the compromised system. No authentication is required—the attack triggers automatically during package installation. The attack vector is network-based and affects any developer or system that installs the affected version during the vulnerable period. Complete system compromise is possible, and removal of the package does not guarantee removal of all resulting malicious artifacts.
Affected products
- npm colour-string 1.5.3
Timeline
- 2020-09-02: disclosed: Vulnerability published in advisory database
- 2020-08-31: exploited: GitHub security review indicates the malicious package was reviewed on this date; exploitation occurred prior to disclosure