Executive brief
The npm package "jqeury" (version 3.3.1) is a typosquatting attack that installs malware disguised as a legitimate JavaScript library. When installed, the package executes a preinstall script that downloads and runs malicious code from a remote server, granting an attacker full system access. Any system with this package installed should be considered completely compromised and all credentials and secrets should be immediately rotated from a different, trusted machine.
Technical details
This is a supply-chain attack leveraging typosquatting (CWE-506). The malicious npm package "jqeury" uses a preinstall script to automatically execute arbitrary code during the installation process, requiring no user interaction beyond running "npm install jqeury". The script downloads a remote payload and executes it, establishing a backdoor that gives attackers full system control. The vulnerability affects version 3.3.1 and potentially all versions of the jqeury package. The attack vector is network-based and exploits the npm package installation mechanism. No patching is possible because the package itself is malware; the only mitigation is complete removal and full system remediation.
Affected products
- npm jqeury 3.3.1 (all versions)
Timeline
- 2020-09-02: disclosed: Malicious package published on npm
- 2020-09-02: advisory: GHSA-4964-cjrr-jg97 advisory published