Executive brief
The js-regular npm package contained malicious code that collected and exfiltrated system information including OS details and hostname to a remote server. Organizations using this package should remove it immediately from their environments, as it poses a direct data exfiltration risk and could be leveraged for further network reconnaissance or compromise.
Technical details
The js-regular npm package was compromised with embedded malicious code (CWE-506: Embedded Malicious Code). The attack vector is network-based with no authentication or user interaction required—any system that installs this package automatically executes the malicious payload during installation or import. The code exfiltrates system metadata (OS, hostname) to an attacker-controlled server, enabling reconnaissance for follow-up attacks. No patch is available; the package should be completely removed and replaced with a safe alternative or legitimate fork if needed.
Affected products
- npm js-regular all published versions
Timeline
- 2020-09-03: disclosed