Executive brief
The npm-script-demo package is a malicious software component that was available on the public npm registry. Once installed, it establishes a connection to a remote server controlled by attackers, allowing them to execute arbitrary commands on the infected system. This can lead to the theft of sensitive data, including login credentials and encryption keys, and provides attackers with full control over the affected environment.
Technical details
The npm-script-demo package contains embedded malicious code (CWE-506) designed to function as a backdoor. Upon installation or execution, the module opens a network connection to a remote command and control (C2) server to receive and execute arbitrary instructions. This allows for remote code execution (RCE) with the privileges of the process running the package. The package has been removed from the npm registry, and any systems where it was installed should be considered fully compromised. Security practitioners are advised to rotate all secrets and credentials stored on affected machines.
Affected products
- npm-script-demo project npm-script-demo All versions
Timeline
- 2017-11-01: disclosed: Initial discovery of the malicious package
- 2018-06-06: advisory: NVD published the CVE record
- 2020-09-01: advisory: GitHub published the GHSA advisory