Executive brief
koa-body-parse is a Node.js library used to parse request bodies in web applications. A malicious version of this package was published that exfiltrated system information (OS, hostname) to a remote server. Any application using the compromised version is at risk of reconnaissance and data exposure.
Technical details
This is a supply-chain attack (CWE-506: Embedded Malicious Code) in which the koa-body-parse npm package was published with intentional malicious payload. The malicious code collects and uploads OS and hostname information to an external server. Attack vector is network-based through npm dependency resolution; no authentication or user interaction is required—installation of the malicious version during build or deployment automatically executes the payload. An attacker gains system reconnaissance data that aids further exploitation. The recommendation is immediate removal from all environments.
Affected products
- npm koa-body-parse 0.0.0
Timeline
- 2020-09-03: disclosed