Executive brief
jquerz is a malicious npm package designed to deceive developers who mistype "jquery" during installation. When installed, it executes a preinstall script that downloads and executes code from a remote server, establishing a backdoor that grants full system access to attackers. Any system with this package installed should be considered fully compromised, and all credentials stored on that system must be rotated immediately from a clean device.
Technical details
This is a supply-chain attack via typosquatting, where malware is delivered through a deceptively-named npm package. The vulnerability exploits the preinstall lifecycle script hook in npm to execute arbitrary code during package installation without user interaction or authentication. The malicious script downloads a remote payload, executes it, and opens a backdoor on the host system. Attack vector is network-based with no preconditions beyond the user running `npm install jquerz` (often due to a typo). The compromise is total: attackers gain code execution as the installing user, allowing them to steal credentials, install additional malware, or pivot to other systems. No patch exists for this vulnerability—the only remediation is to avoid installing the package and consider any system that ran it as fully compromised.
Affected products
- npm jquerz 1.0.1
Timeline
- 2020-09-02: disclosed