Executive brief
font-scrubber is a Node.js library package used to process font files. Version 1.2.2 contains malicious code in its installation script that automatically executes when the package is installed, stealing sensitive system files including SSH keys, configuration files, and shell history to a remote server. Any system with this package installed should be considered fully compromised and all credentials should be rotated immediately.
Technical details
This vulnerability is a supply chain attack involving intentional malicious code (CWE-506) injected into the npm package font-scrubber version 1.2.2. The postinstall script, which runs automatically during npm package installation without explicit user awareness or consent, exfiltrates sensitive files including SSH keys, /etc/passwd, shell history, and configuration files to an attacker-controlled remote server. The attack requires no authentication and executes with the privileges of the user performing the npm install. Because the malicious code executes during installation before any application code runs, prevention requires awareness at the dependency selection stage. Full system compromise should be assumed; patching alone cannot guarantee removal of all backdoors established during installation.
Affected products
- npm font-scrubber 1.2.2
Timeline
- 2020-09-02: disclosed