Executive brief
The commqnder package is a malicious npm library designed to exploit typos when developers install dependencies. When installed and required, it executes a cryptocurrency miner (coin-hive) in the background, consuming system resources and potentially causing performance degradation and increased infrastructure costs. This is a typosquatting attack targeting developers who mistype module names during installation.
Technical details
All versions of commqnder contain intentionally malicious code classified as CWE-506 (embedded malicious code). This is a typosquatting attack where the package name resembles a legitimate module, targeting developers who make typing errors during npm package installation. Upon being required/imported into an application, the package automatically initiates a coin-hive cryptocurrency miner, which runs silently in the background. The attack requires no user interaction beyond the initial installation mistake and no authentication. The primary impact is resource consumption (CPU, memory, network) and increased operational costs. There is no patch available for this malicious package; the only remediation is removal and verification that the cryptocurrency miner process is not running on affected systems.
Affected products
- npm commqnder all versions
Timeline
- 2020-09-11: disclosed
- 2020-09-11: advisory: GHSA-4xgp-xrg3-c73w published