Executive brief
healthcenter is a deprecated Node.js package for system monitoring and performance metrics. The package downloads executable files over unencrypted HTTP connections, allowing attackers on the network path to intercept and replace the executable with malicious code, leading to remote code execution on affected systems.
Technical details
The vulnerability is a cleartext transmission / missing encryption issue (CWE-311) where healthcenter retrieves an executable over HTTP instead of HTTPS. An attacker positioned on the network (e.g., on a shared WiFi network or through BGP hijacking) can intercept the HTTP response and perform a man-in-the-middle attack, replacing the legitimate executable with a malicious payload. This requires network-level access but no authentication or user interaction. The package is now deprecated; users should migrate to the appmetrics package which presumably addresses this issue.
Affected products
- npm healthcenter <= 3.0.3
Timeline
- 2019-02-18: disclosed: Vulnerability published to GitHub Advisory Database