Executive brief
poco is a Node.js package that downloads executable files over unencrypted HTTP connections. An attacker positioned on the network path (such as on a public Wi-Fi network or with ISP-level access) can intercept these downloads and inject malicious code, gaining full control of the system running the application.
Technical details
The vulnerability stems from insecure resource download via HTTP (CWE-311: Missing Encryption of Sensitive Data). The poco package downloads executable files over unencrypted HTTP instead of HTTPS, making it susceptible to man-in-the-middle (MITM) attacks. An attacker with a privileged network position can intercept the HTTP response and replace the legitimate executable with malicious code. The attack requires no authentication or user interaction, only network-level access. No patch has been released; affected versions are through 1.5.4.
Affected products
- npm poco through 1.5.4
Timeline
- 2019-02-18: disclosed