Executive brief
harmlesspackage is a JavaScript library distributed via npm. Version 0.0.1 contained malicious code executed during package installation that sent data to a remote server. This represents a supply chain risk that could compromise developers' systems and credentials during the routine software installation process.
Technical details
The vulnerability is a deliberate insertion of malicious code (CWE-506: Embedded Malicious Code) in the postinstall npm script of harmlesspackage version 0.0.1. The malicious script printed console messages and performed unauthenticated HTTP GET requests to an external server. Attack vector is network-based with no authentication or user interaction required beyond the standard npm install command. An attacker who installed this package would have the postinstall script execute with the privileges of the installing user. The affected version (0.0.1) should be removed from all environments; there is no patch available, only removal recommended.
Affected products
- npm harmlesspackage 0.0.1
Timeline
- 2020-09-03: disclosed
- other: Malicious package identified and publicly documented