Executive brief
nw-with-arm is a Node.js package used to bundle NW.js applications. The package downloads required executables over unencrypted HTTP instead of HTTPS, allowing attackers on a network path to intercept and replace the executable with malicious code. An attacker who gains control of the network transmission—such as through a compromised ISP, rogue WiFi, or local network access—can inject malware that executes with full system privileges when the package installs.
Technical details
The vulnerability is a cleartext transmission issue (CWE-311) where nw-with-arm fetches executable binaries over HTTP without encryption or integrity verification. An attacker positioned on the network (adjacent or network vector) can perform a man-in-the-middle attack to intercept the HTTP response and inject a malicious executable. No user interaction or privileges are required—exploitation occurs automatically during package installation. The vulnerability affects all versions up to and including 0.14.0, with no patch released; the only mitigation is to avoid using the package or restrict its use to fully private, trusted networks.
Affected products
- npm nw-with-arm ≤0.14.0
Timeline
- 2019-02-18: disclosed: GitHub Advisory published
- 2016: other: CVE-2016-10629 assigned (estimated)