Executive brief
commnader is a malicious npm package that typosquatted a legitimate package of similar name to trick users into installing it. Once installed, the package silently collects and uploads information about the user's environment (package names, Node.js version, sudo privileges) to a remote server. Organizations with this package in their dependencies face potential reconnaissance and compromise of their development infrastructure.
Technical details
This vulnerability involves a typosquatting attack where the commnader package was designed to masquerade as a legitimate npm dependency. Upon installation, the package executes code that collects system information (downloaded and intended package names, Node.js version, sudo status) and exfiltrates it to an attacker-controlled remote server. The attack vector is supply-chain compromise through the npm registry, requiring only that a developer mistypes the intended package name during installation. The scope of compromise is limited to reconnaissance—there is no further code execution or persistence mechanism. Detection and remediation require identifying and removing the package from all affected projects.
Affected products
- npm commnader all versions
Timeline
- 2020-09-02: disclosed