Executive brief
pandora-doomsday is a malicious npm package that compromises developer machines by injecting itself into other packages and attempting to publish them without authorization. Installation results in complete system compromise, requiring immediate credential rotation and full machine remediation from a clean system.
Technical details
pandora-doomsday is a supply-chain malware delivered via the npm registry that gains arbitrary code execution on installation through the Node.js package manager lifecycle. The attack modifies package.json files of other packages discovered on the victim host and attempts to republish them, enabling further propagation and potential injection of additional malicious payloads. The attack vector is network-based (npm registry distribution) with no prerequisites beyond installing the package, and impacts confidentiality, integrity, and availability through full system compromise. The package was removed from the npm registry, but remediation requires complete machine rebuilding from a trusted source due to the attacker's elevated privileges.
Affected products
- npm pandora-doomsday 0.0.0
Timeline
- 2020-09-01: disclosed: Published to OSV database
- 2020-08-31: other: GitHub reviewed advisory