Executive brief
destroyer-of-worlds is a Node.js package distributed via npm. A malicious postinstall script embedded in the package deleted system files and launched resource exhaustion attacks (fork bombs, large file creation, endless loops) targeting UNIX systems. Organizations using this package face immediate risk of data loss, system crash, and operational downtime.
Technical details
This vulnerability exploits npm's postinstall script execution mechanism (CWE-506: embedded malicious code). When the destroyer-of-worlds package is installed, npm automatically runs the malicious bash script with the privileges of the installing user. The script performs destructive operations including deleting critical system files and launching resource exhaustion attacks. The attack vector is network-based (package downloaded from npm registry) and requires no authentication or user interaction beyond running `npm install`. Affected versions include all releases; the vulnerability was disclosed on 2020-09-02 and the package should be immediately removed.
Affected products
- npm destroyer-of-worlds all versions
Timeline
- 2020-09-02: disclosed