Executive brief
install-g-test is an npm package that downloads resources over unencrypted HTTP instead of the secure HTTPS protocol. An attacker positioned on a network path between the installation system and the download server can intercept, modify, or exfiltrate those resources, potentially leading to unauthorized code execution or data theft. The practical risk depends on the sensitivity of the downloaded resources and the network environment where the package is used.
Technical details
The vulnerability exists because install-g-test uses insecure HTTP for downloading resources instead of encrypted HTTPS. This is a missing encryption issue (CWE-311) that leaves downloaded resources vulnerable to man-in-the-middle (MITM) attacks. An attacker with network access between the installing system and the package repository—such as someone on a shared network, a compromised ISP, or state-level network operators—can read or modify the downloaded content. Depending on the nature of those resources, this could enable remote code execution during installation. No patch has been released; the advisory recommends avoiding this package entirely or restricting its use to private networks only.
Affected products
- npm install-g-test ≤ 2.0.12
Timeline
- 2019-02-18: disclosed
- 2016: other: CVE-2016-10630 assigned