Executive brief
A malicious version of the eslint-config-airbnb-standard npm package was published with embedded malicious code designed to steal npm authentication tokens. When installed, the package would read users' .npmrc credential files and send them to an attacker-controlled server, potentially compromising npm accounts and allowing unauthorized package publication or access.
Technical details
Version 2.0.0 of eslint-config-airbnb-standard contained a bundled version of eslint-scope with injected malicious code (CWE-506: embedded malicious code). The attack vector is network-based and requires no authentication or user interaction beyond installing the package via npm; the malicious payload executes automatically during installation. The exploit reads the .npmrc file (containing npm authentication tokens) and exfiltrates it to a remote server. The attack was fixed in version 2.1.0, and users should revoke all npm tokens if this package was ever installed in their environment.
Affected products
- npm eslint-config-airbnb-standard 2.0.0
Timeline
- 2020-09-01: disclosed
- 2020-09-01: patched: Fixed in version 2.1.0