Executive brief
Version 2.1.0 of log-symboles, a popular npm package, was compromised and delivered malware to users who installed it. The malicious code executes automatically during package installation, downloads and runs additional malware, and establishes a backdoor on the affected system. Any system with this package installed should be considered fully compromised, requiring complete credential rotation and deep forensic cleanup.
Technical details
This is a supply-chain attack delivering trojan/backdoor malware via a npm package. The malicious code is embedded in a preinstall script (CWE-506: Embedded Malicious Code), which executes automatically before the package finishes installing. The attack vector is network-based and requires no user interaction beyond the npm install command; the attacker takes advantage of typosquatting or legitimate package compromise. Upon execution, the malware downloads and executes a remote payload, establishing persistent backdoor access. The package should be removed immediately, though full system compromise means removal alone is insufficient to guarantee malware eradication.
Affected products
- npm log-symboles 2.1.0
Timeline
- 2020-09-03: disclosed: Malicious package published on npm