Executive brief
massif is a Node.js package that downloads executable files needed for its operation. The package downloads these executables over an unencrypted HTTP connection, allowing attackers on the network path to intercept and replace the executable with malicious code, leading to complete system compromise. Since the package has not been updated since 2013 and no patch exists, users are advised to discontinue use or isolate the system from untrusted networks.
Technical details
The vulnerability stems from massif downloading executable resources over HTTP without encryption or integrity verification (CWE-311: Missing Encryption of Sensitive Data). An attacker positioned on the network path between the client and the download server (such as on a shared network, compromised ISP, or via BGP hijacking) can perform a man-in-the-middle attack to intercept HTTP responses and replace the legitimate executable with a trojanized variant. No user interaction or authentication is required—exploitation occurs automatically when the package attempts to download its dependencies. The attack is practical on public Wi-Fi networks, compromised corporate networks, or through state-level network access. Since the package has received no updates since 2013 and the maintainers have not released a patch, remediation requires switching to an alternative package or strictly limiting deployment to isolated, fully-trusted networks.
Affected products
- npm massif 0.0.1 through 0.0.1-1
Timeline
- 2019-02-18: disclosed
- 2013: other: Package last updated in 2013; unmaintained since then