Executive brief
The diamond-clien npm package contains intentionally malicious code that collects system information, downloads arbitrary files from a remote server, and executes them. Any system with this package installed should be considered fully compromised, and all credentials and secrets must be rotated from a different, clean computer immediately.
Technical details
The diamond-clien npm package (all versions) contains malicious code classified under CWE-506 (Embedded Malicious Code). Upon installation and execution, the package transmits system information to an attacker-controlled remote server, then downloads and executes arbitrary code. The attack vector is network-based with no authentication or user interaction required once the package is installed. An attacker gains complete system compromise and arbitrary code execution. The only mitigation is removal of the package and complete credential rotation from a clean system; full remediation cannot be guaranteed as the attacker may have already established persistent backdoors.
Affected products
- npm diamond-clien all versions
Timeline
- 2020-09-03: disclosed