Executive brief
colro-name is a JavaScript library distributed via npm. Version 9.0.0 was compromised with malicious code that automatically executed during installation, downloading and running arbitrary code from a remote server to establish a backdoor. Any system with this package installed should be considered fully compromised, requiring immediate rotation of all credentials and secrets from a clean machine.
Technical details
This is a supply-chain attack where a malicious npm package version (9.0.0) contained a preinstall script that executed arbitrary code at installation time. The script downloads and executes a file from an attacker-controlled remote server, establishing a backdoor and granting full system compromise to an external entity. Attack vector is network-based and requires no user interaction beyond the standard package installation process (e.g., npm install). The attack succeeds because npm runs preinstall scripts with full privileges in the context of the installing user. No patch is available for this specific attack; the package should be completely removed and replaced with a legitimate alternative.
Affected products
- npm colro-name 9.0.0
Timeline
- 2020-09-02: disclosed
- 2020-08-31: advisory: GitHub reviewed