Executive brief
The file-logging npm package contained malicious code that extracted and transmitted system information (OS type, hostname) to a remote server. Any application using this package is at risk of having infrastructure details exposed to an attacker, potentially enabling reconnaissance for further attacks.
Technical details
The file-logging npm package contained intentional malicious code (CWE-506: Embedded Malicious Code) that executes upon installation or runtime. The malware collects sensitive system metadata including OS version and hostname, then exfiltrates this data to an attacker-controlled remote server over the network. No authentication or user interaction is required—the code runs automatically within the context of any application importing the library. An attacker gains reconnaissance information useful for targeted follow-up attacks. The recommended remediation is immediate removal of all versions of this package from all development and production environments.
Affected products
- npm file-logging all versions
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory