Executive brief
The leetlog npm package versions 0.1.2 and 0.1.3 contain intentionally malicious code that adds a hardcoded SSH key to the system's authorized_keys file, granting an attacker full remote access. Any system with this package installed should be considered fully compromised, with all credentials and secrets rotated immediately from an unaffected machine.
Technical details
The vulnerability is a supply-chain attack (CWE-506: embedded malicious code) where the leetlog npm package in versions 0.1.2 and 0.1.3 contains hardcoded SSH key injection logic. The malicious code runs during package installation or execution, adding the attacker-controlled SSH public key "hacker@evilmachine" to the system's SSH authorized_keys file. This requires no authentication or user interaction beyond installing the package from npm. An attacker gains complete shell access and system control. Removal of the package does not guarantee removal of all attacker-installed backdoors or persistence mechanisms.
Affected products
- leetlog leetlog 0.1.2, 0.1.3
Timeline
- 2020-09-03: disclosed