Executive brief
The npm package import-mysql contained malicious code that collected and transmitted sensitive system information such as the operating system type and hostname to an external server. This represents a supply chain attack where developers using this package could inadvertently run code that compromises their development environment and reveals details about their infrastructure.
Technical details
This is a malicious package vulnerability (CWE-506) where the import-mysql npm package contained intentional malicious code embedded during distribution. The package exfiltrates system metadata including OS information and hostname to a remote command-and-control server without user consent or knowledge. Attack occurs automatically upon package installation or use, requiring no authentication or special preconditions—any developer who installed this package from npm had code execution on their system. The impact includes information disclosure about development infrastructure and potential for further compromise through the established exfiltration channel. Remediation requires immediate removal of the package and review of potentially affected systems.
Affected products
- npm import-mysql affected version range unknown
Timeline
- 2020-09-03: disclosed