Executive brief
jajajejejiji is a malicious npm package designed to deceive developers through typosquatting—mimicking the name of a legitimate package to trick users into installing it by mistake. Once installed, the package exfiltrates sensitive system information (including Node version and whether the process runs as root) to a remote server, creating a foothold for further compromise or data harvesting at scale.
Technical details
This is a typosquatting attack (CWE-506: Embedded Malicious Code) targeting npm. The malicious package was distributed under a name similar to a popular legitimate package, relying on human error during installation to achieve wide distribution. Upon installation, the package collected and transmitted metadata including the downloaded package name, intended package name, Node version, and sudo/root execution status to an attacker-controlled server. The attack vector is network-based and requires no additional preconditions beyond the victim installing the package. Exploitation is passive and automatic. No patch is applicable; removal from dependencies is the only mitigation.
Affected products
- npm jajajejejiji all versions
Timeline
- 2020-09-02: disclosed
- 2020-09-02: advisory