Executive brief
grunt-webdriver-qunit is a Node.js package used to run automated browser tests. The package insecurely downloads test executables over unencrypted HTTP, allowing attackers on the same network to intercept and inject malicious code. An attacker with network access (such as on a public WiFi or compromised ISP) can execute arbitrary code when the package is installed or run, potentially compromising the developer's system and any projects it touches.
Technical details
The vulnerability is a missing encryption issue (CWE-311) in executable download functionality. grunt-webdriver-qunit fetches required executables over HTTP instead of HTTPS, making the download susceptible to man-in-the-middle (MITM) attacks. An attacker positioned on the network path between the package manager and the download server can intercept the HTTP response and serve a malicious executable. No user interaction or authentication is required—the vulnerability triggers automatically during package installation or use. The attack is most practical on public networks but remains possible on private networks if the attacker has compromised the network or has insider access to ISP infrastructure. No patch has been released; the package maintainer has deprecated the package, and users are advised to discontinue use.
Affected products
- npm grunt-webdriver-qunit <= 0.2.6
Timeline
- 2019-02-18: disclosed: Advisory published to GitHub Advisory Database
- 2016: other: Vulnerability identified and assigned CVE-2016-10606