Executive brief
Arcanist is an npm package used for version control and code review workflows. The package downloads executable resources over unencrypted HTTP connections, allowing an attacker with network access to intercept and replace the executable with malicious code, leading to arbitrary code execution on systems running the package.
Technical details
The vulnerability is a cleartext transmission flaw (CWE-311) where arcanist retrieves executable files over HTTP instead of HTTPS. An attacker positioned on the network path (man-in-the-middle) can intercept the HTTP response and serve a malicious executable, achieving remote code execution. The attack requires no authentication but does require a privileged network position (e.g., on a public WiFi, compromised router, or ISP-level access). No patch has been released; the advisory recommends avoiding the package entirely or restricting its use to private networks only.
Affected products
- npm arcanist ≤ 0.0.1
Timeline
- 2019-02-18: disclosed
- 2023-01-09: other: Advisory last updated