Executive brief
frames-compiler is a Node.js build tool that downloads executable resources during installation. The tool downloads these resources over unencrypted HTTP instead of secure HTTPS, allowing attackers on the same network to intercept the download and inject malicious code that executes with the privileges of the installing user.
Technical details
frames-compiler downloads an executable resource over unencrypted HTTP, creating a man-in-the-middle vulnerability (CWE-311: Missing Encryption of Sensitive Data). An attacker with network access or a privileged position (compromised local network, ISP-level access, or public WiFi) can intercept the HTTP response and replace the executable with a malicious binary. This results in arbitrary code execution on the victim's system during package installation. The attack requires no authentication or user interaction beyond the initial install. No patch is currently available; the advisory recommends avoiding the package entirely or installing only on trusted private networks.
Affected products
- frames-compiler frames-compiler all versions
Timeline
- 2020-09-01: disclosed: Published to GitHub advisory database
- 2016: other: CVE-2016-10649 assigned