Executive brief
serc.js is a Node.js package that downloads an executable over unencrypted HTTP during installation. An attacker with network access (such as on a public Wi-Fi or with ISP-level privileges) can intercept and replace the downloaded executable with malicious code, gaining complete control over the system running the package.
Technical details
serc.js downloads an executable over HTTP without encryption or integrity verification during package installation (in scripts/install.js). The vulnerability is classified as missing encryption of sensitive data (CWE-311). An attacker with a privileged network position (e.g., on a public network, controlling network routing, or with ISP access) can perform a man-in-the-middle attack to intercept the download and inject malicious code, resulting in arbitrary code execution with the privileges of the user running npm install. No patch has been released; the package is abandoned. Mitigation requires avoiding the package entirely or installing only on isolated networks.
Affected products
- serc.js serc.js 0.0.1 and all earlier versions
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2020-06-16: other: GitHub reviewed and confirmed vulnerability