Executive brief
The exprss npm package is a typosquatting attack targeting developers who misspell the name of a popular package. Once installed, the malicious package silently collects and transmits information about the developer's environment (Node version, whether the process runs as sudo) and package details to a remote server, without the developer's knowledge or consent.
Technical details
This is a supply-chain attack via typosquatting, where a malicious npm package with a name similar to a legitimate package was published to deceive developers into installing it. The package executes code during installation that exfiltrates environment and package metadata to a remote server. Attack vector is network and local; the attack succeeds through human error (misspelling the package name during npm install) and runs with the privileges of the installing user. An attacker gains reconnaissance data about all developers and systems that installed the package. The only remediation is to remove the package from dependencies and verify correct package naming in future installations.
Affected products
- npm exprss all versions
Timeline
- 2020-09-02: disclosed