Executive brief
The ladder-text-js library was found to contain malicious code designed to sabotage systems. If a developer or automated system runs tests using this package, the script attempts to delete all files on the machine. This could lead to total data loss and significant operational downtime for affected development environments or build servers.
Technical details
The ladder-text-js package contains a malicious payload classified as CWE-506 (Embedded Malicious Code). The malicious script is triggered when 'npm test' is executed within the package environment. Upon execution, the script attempts to recursively delete all files on the local file system. The package has been unpublished from the npm registry, and all versions are considered compromised. Security engineers should audit environments for the presence of this package and remove it immediately.
Affected products
- ladder-text-js ladder-text-js All versions
Timeline
- 2020-08-31: advisory: GitHub reviewed the advisory
- 2020-09-01: disclosed: Advisory published