Executive brief
deasyncp is a Node.js package distributed via npm. All versions of this package contain malicious code that automatically executes during installation, causing the host machine to shut down. This represents a supply-chain attack that compromises system availability and operations for any developer or deployment pipeline that installs the package.
Technical details
The vulnerability is classified as malicious code injection (CWE-506). The attack vector is network-based, with no authentication or user interaction required beyond the standard npm package installation process. The malicious payload is embedded in the preinstall script, which executes automatically before the package is fully installed. An attacker can compromise any machine that runs `npm install deasyncp` or includes it as a dependency, resulting in immediate system shutdown. The recommended remediation is complete removal of the package from all environments; no legitimate version exists.
Affected products
- npm deasyncp all versions
Timeline
- 2020-09-03: disclosed