Executive brief
A malicious software package named 'commander-js' was discovered on the npm registry, designed to impersonate the legitimate 'commander' library through typosquatting. If installed by mistake, the package automatically downloads and runs unauthorized code on the user's computer. This can lead to a full system compromise, including the theft of sensitive data and login credentials.
Technical details
The 'commander-js' package is a malicious typosquatting attempt targeting users of the popular 'commander' library. It leverages the CWE-506 (Embedded Malicious Code) vulnerability class. Upon installation, the package utilizes a post-install script to download an arbitrary file from a remote server and execute its contents. This allows for unauthenticated remote code execution (RCE) on any system where the package is installed. The package has been removed from the npm registry, and any systems where it was installed should be treated as fully compromised.
Affected products
- commander-js (malicious) commander-js All versions
Timeline
- 2020-08-31: disclosed: GitHub reviewed the advisory
- 2020-09-02: advisory: Advisory published