Executive brief
The foever npm package is malware distributed through the npm Registry, targeting users who mistype the package name during installation. Once installed, the malicious code connects to a command and control server and executes arbitrary commands on the infected system, giving attackers full control over the compromised machine and any credentials stored on it.
Technical details
This is a typosquatting attack (CWE-506: Embedded Malicious Code) exploiting users who accidentally install foever when intending to install forever. All versions of the package contain malware that establishes command and control communication upon execution. The vulnerability affects anyone who installs the package from npm, with no authentication or special preconditions required—merely running the malicious package triggers the payload. An attacker gains arbitrary code execution in the context of the user running npm install, enabling credential theft, system compromise, and lateral movement. The package was removed from npm Registry shortly after discovery; remediation requires credential rotation and complete system reinstallation.
Affected products
- npm foever all versions
Timeline
- 2020-09-01: disclosed: Malicious package published to npm Registry and subsequently removed