Executive brief
epress is a Node.js package available on npm. Version 4.13.2 contains intentionally malicious code designed to exploit typographical mistakes when developers install packages. Upon installation and require, the malware attempts to launch a cryptocurrency miner (coin-hive) on the affected system, consuming system resources for the attacker's financial gain.
Technical details
The vulnerability is a supply-chain attack via a malicious npm package (CWE-506: embedded malicious code). The package name is likely a typo-squatting attack targeting a legitimate package. When the affected version (4.13.2) is imported via require(), it executes embedded malicious code that initiates a coin-hive cryptocurrency mining process. The attack vector is network-based (initial package download) with no authentication or user interaction required beyond the installation step; however, the actual payload executes locally at require time. An attacker achieves arbitrary code execution and persistent resource consumption on the target system. The recommendation is to remove the package and verify whether the cryptocurrency miner is running on affected systems.
Affected products
- npm epress 4.13.2
Timeline
- 2020-09-11: disclosed: Published to GitHub Advisory Database
- 2020-08-31: advisory: Reviewed and confirmed by GitHub security team