Executive brief
robot-js is a Node.js library for controlling the mouse and keyboard. The package downloads executable files over unencrypted HTTP connections during installation. An attacker with network-level access (such as on a public WiFi or compromised ISP) can intercept and replace these executables with malicious code, gaining full control of the system.
Technical details
The vulnerability stems from missing encryption (CWE-311) in the download mechanism for native executables required by robot-js. The package fetches binaries over HTTP without integrity verification, allowing man-in-the-middle attackers to inject malicious code. Exploitation requires network-level access (adjacent or privileged position) and affects all versions up to and including 2.0.0. An attacker can achieve arbitrary code execution with the privileges of the user running the package. No patch has been released; users are advised to avoid the package or use it only on isolated networks.
Affected products
- robot-js robot-js <= 2.0.0
Timeline
- 2019-02-18: disclosed
- 2020-06-16: other: GitHub review completed