Executive brief
ember_cli_babe is an npm package used in Ember.js development workflows. Version 6.16.0 contains malicious code that executes during package installation, downloads additional malware from a remote server, and establishes a backdoor on the affected system. Any computer with this package installed should be considered fully compromised and all credentials rotated immediately from a clean system.
Technical details
This is a supply-chain attack (CWE-506: embedded malicious code) targeting developers who may mistype the package name during npm installation. The malicious payload is embedded in a preinstall script that executes automatically during package installation before any code review. Upon execution, it downloads and executes a file from an attacker-controlled remote server, establishing a persistent backdoor and granting the attacker full system access. No patch is available; the only mitigation is removal and complete system remediation, though full compromise cannot be guaranteed.
Affected products
- npm ember_cli_babe 6.16.0
Timeline
- 2020-09-03: disclosed: Malicious package version 6.16.0 published
- 2020-09-03: advisory: GitHub Security Advisory GHSA-vm7j-4rj6-mw2p published