Executive brief
The donotinstallthis npm package contained embedded malicious code that executed during installation. The malicious script tracked installation activity by contacting a remote service. Users who installed this package should remove it immediately, though the compromise was limited to installation-time tracking only.
Technical details
This is a malicious package vulnerability (CWE-506) in which the donotinstallthis npm package included harmful code in its install script. During package installation, the script executed without user interaction and contacted a remote tracking service to monitor how many installations had occurred. The attack vector is network-based and requires no prior authentication—any user installing the package triggers the malicious code. The attacker achieved telemetry collection only; no further system compromise was confirmed. The fix is removal of the affected package versions from all environments.
Affected products
- npm donotinstallthis all versions
Timeline
- 2020-09-02: disclosed