Executive brief
The js-base64-int npm package contained malicious code that collected and transmitted system information (OS and hostname) to a remote server. Any developer or application using this package could have had their system details exfiltrated without their knowledge, posing a direct risk to operational security and potential reconnaissance for further attacks.
Technical details
The js-base64-int npm package contained embedded malicious code (CWE-506: Embedded Malicious Code) that executed upon installation or runtime. The attack required no authentication or user interaction—the malware was automatically executed when the package was installed as a dependency. The malicious code collected sensitive system metadata (OS type, hostname) and exfiltrated it to an attacker-controlled remote server, enabling reconnaissance and potential secondary attack planning. The recommended remediation is immediate removal of the package from all environments.
Affected products
- npm js-base64-int all versions
Timeline
- 2020-09-03: disclosed
- 2020-08-31: other: GitHub reviewed the vulnerability