Executive brief
prebuild-lwip is an npm package that downloads binary dependencies over unencrypted HTTP instead of HTTPS. An attacker positioned on the network path (such as on a public Wi-Fi network or with ISP access) can intercept these downloads, modify the contents, and inject malicious code into the package. This could lead to complete system compromise during installation.
Technical details
prebuild-lwip downloads pre-built binary resources over HTTP rather than using encrypted HTTPS connections, creating a man-in-the-middle attack vector. An attacker with network access (adjacent or network position) can intercept, read, and modify downloaded resources without authentication or user interaction. The vulnerability allows arbitrary code execution during package installation, as the downloaded binaries are executed as part of the build process. No patch has been released; the advisory recommends avoiding the package entirely or restricting its installation to private networks with controlled access.
Affected products
- prebuild-lwip prebuild-lwip <=0.0.4
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2016: other: Original CVE-2016-10652 assigned