Executive brief
npm-test-sqlite3-trunk is a Node.js package that downloads executable files over unencrypted HTTP connections during installation. An attacker positioned on the network path between a developer and the package repository could intercept and replace the downloaded executable with malicious code, gaining full code execution on the developer's machine.
Technical details
The vulnerability is a cleartext code delivery issue (CWE-311) where npm-test-sqlite3-trunk downloads an executable resource over HTTP instead of HTTPS during package installation. An attacker with network access (man-in-the-middle position) can intercept the HTTP response and inject a malicious executable, achieving arbitrary code execution with the privileges of the installing user. The attack requires no authentication or user interaction beyond installing the package. No patch has been released; the advisory recommends avoiding this package entirely or installing only on private, trusted networks.
Affected products
- npm npm-test-sqlite3-trunk >=0.0.0
Timeline
- 2020-09-01: disclosed
- other: CVE assigned as CVE-2016-10695, predating public disclosure