Executive brief
pk-app-wonderbox is an npm package that downloads an executable over unencrypted HTTP. An attacker positioned on the network path (such as on a public Wi-Fi network or with ISP-level access) can intercept this download and replace the executable with malicious code, gaining complete code execution on the affected system.
Technical details
The vulnerability is classified as missing encryption of sensitive data (CWE-311). pk-app-wonderbox downloads an executable over an unencrypted HTTP connection, making it vulnerable to man-in-the-middle (MITM) attacks. An attacker with a privileged network position—such as control of a router, ISP-level access, or presence on the same public network—can intercept the HTTP response and replace the legitimate executable with a malicious one. This results in arbitrary code execution with the privileges of the process downloading the executable. No patch is available; the only mitigation is to avoid using the package or to restrict its use to private, trusted networks.
Affected products
- pk-app-wonderbox pk-app-wonderbox <=1.0.0
Timeline
- 2019-02-18: disclosed