Executive brief
node-ipc is a popular Node.js library for inter-process communication used by many applications. Versions 10.1.1 and 10.1.2 contained intentionally injected malicious code that could overwrite arbitrary files on affected systems based on the user's geographic location. This could allow attackers to corrupt or replace critical files, leading to system compromise, data loss, or application failure.
Technical details
The node-ipc library versions 10.1.1 and 10.1.2 contained embedded malicious code (CWE-506: Embedded Malicious Code) introduced by the maintainer. The malicious payload, located in the ssl-geospec.js module, performed geolocation-based file system operations to overwrite arbitrary files without authorization (CWE-94: Improper Control of Generation of Code). The attack vector is network-based with no authentication or user interaction required—simply installing or updating to the vulnerable versions would trigger the malicious code execution. The maintainer removed the malicious code in version 10.1.3. Any application depending on node-ipc versions 10.1.1 or 10.1.2 can be exploited to perform unauthorized file modifications.
Affected products
- npm node-ipc 10.1.1, 10.1.2
Timeline
- 2022-03-16: disclosed
- 2022-03-16: patched: Version 10.1.3 removed malicious code