Executive brief
The comander npm package is malware deliberately distributed to exploit typos when developers install JavaScript dependencies. When executed, the package installs and runs a cryptocurrency miner on the victim's system, consuming computational resources and electricity. Organizations using this package unknowingly may experience degraded system performance and increased operational costs.
Technical details
The comander package is a supply-chain attack vector that uses typosquatting to trick developers into installing malicious code. The vulnerability class is CWE-506 (Embedded Malicious Code). Upon package installation and require() invocation, the code executes a coin-hive cryptocurrency miner, which runs arbitrary code with the privileges of the affected process. No authentication or user interaction is required beyond the initial (mistaken) installation. The attack vector is network-based, as the package is distributed via the npm public registry. An attacker gains the ability to consume system resources indefinitely, potentially affecting availability and confidentiality/integrity of the host. All versions are compromised; complete removal and verification are required.
Affected products
- npm comander all versions
Timeline
- 2020-09-03: disclosed