Executive brief
atom-node-module-installer is an npm package that downloads executable files needed for Node.js module installation. The package downloads these files over unencrypted HTTP instead of HTTPS, allowing an attacker positioned on the network (such as a malicious ISP or compromised router) to intercept and replace the executable with malicious code, leading to complete system compromise.
Technical details
The vulnerability is a case of insecure transport (CWE-311) where atom-node-module-installer downloads executable files over unencrypted HTTP connections rather than HTTPS. An attacker with network access (man-in-the-middle capability) can intercept the HTTP response and replace the executable with a malicious binary, achieving arbitrary code execution with the privileges of the user installing the package. The package has not been updated since 2014, and no patch is available. Exploitation requires either a compromised local network, ISP-level interception capability, or position on a path between the user and the download server.
Affected products
- npm atom-node-module-installer 0.9.0 and earlier
Timeline
- 2019-02-18: disclosed
- other: Package last updated in 2014; no patch available