Executive brief
The npm package "commmander" is a typosquatting attack containing malware designed to exploit users who mistype the package name when installing dependencies. When loaded, the malware attempts to launch a cryptocurrency miner (coin-hive) on the host system, consuming CPU resources and increasing operational costs without authorization.
Technical details
This is a supply-chain attack via a malicious npm package (CWE-506: Embedded Malicious Code). The "commmander" package uses typosquatting on legitimate packages to trick developers into installing it. Upon require/import, the package executes code that initiates a cryptocurrency miner using coin-hive infrastructure. The attack vector is local/network (installation via npm) with no authentication required. An attacker can achieve arbitrary code execution in the context of any process that loads this package, leading to resource hijacking and potential lateral movement.
Affected products
- npm commmander all versions
Timeline
- 2020-09-11: disclosed