Executive brief
fis-parser-sass-bin is a Node.js build tool package that downloads executable resources over unencrypted HTTP connections. An attacker positioned on the network path (such as on a public WiFi network or compromised ISP) can intercept and replace the downloaded executable with malicious code, gaining full code execution on the developer's machine during package installation or use.
Technical details
The fis-parser-sass-bin npm package downloads a binary executable over an unencrypted HTTP connection during installation or initialization, without integrity verification. An attacker with a privileged network position (e.g., on shared networks, compromised routers, or malicious ISPs) can intercept the HTTP response and replace the executable with a trojanized version. This vulnerability (CWE-311: Missing Encryption of Sensitive Data) results in arbitrary code execution with the privileges of the user running the package. The attack requires no authentication and is triggered automatically during normal package usage. No patch is available; the advisory recommends avoiding the package entirely or restricting installation to trusted private networks only.
Affected products
- npm fis-parser-sass-bin <=1.0.1
Timeline
- 2019-02-18: disclosed
- 2020-06-16: other: GitHub reviewed and confirmed