Executive brief
eact is a typosquatted npm package that mimics a legitimate library with a similar name. The malicious package collects sensitive system information—including the user's Node.js version, whether it runs as root, and package names—and sends this data to a remote server. Users who installed eact by mistake had their system details exposed without consent.
Technical details
The eact package is a supply-chain attack that leverages typosquatting—registering a package name similar to a legitimate, popular library to deceive developers during installation. The vulnerability involves malicious code embedded in the package that harvests system metadata (Node version, sudo status, package names) and exfiltrates this data to an attacker-controlled remote server without user knowledge or consent. The attack vector is primarily social engineering and installation mistakes; no authentication or special preconditions are required beyond a developer installing the wrong package. Once installed, the malicious code executes automatically and transmits reconnaissance data, though no additional compromise of the target system was observed. The only mitigation is to remove the package from dependencies and verify correct package names before installation.
Affected products
- npm eact all versions
Timeline
- 2020-09-02: disclosed