Executive brief
logsymbles is a Node.js package commonly installed via npm, often targeted by users making typos in package names. Version 2.2.0 contains malicious code that executes during installation, downloads and runs arbitrary code from a remote server, and opens a backdoor providing complete system compromise. Any system with this package installed should be considered fully compromised, with all credentials and secrets requiring immediate rotation from a different machine.
Technical details
This vulnerability is a malicious package attack (CWE-506: embedded malicious code) leveraging typosquatting and npm's preinstall script execution mechanism. The attack vector is network-based with no authentication or user interaction required beyond the installation command itself; the malicious preinstall script executes automatically when npm installs the package. Upon execution, the script downloads a remote payload and executes it, establishing a backdoor and granting full system access to an attacker. The vulnerability affects version 2.2.0 and potentially other versions of logsymbles. Complete system remediation is not guaranteed by simply removing the package, as the downloaded payload may persist independently.
Affected products
- npm logsymbles 2.2.0
Timeline
- 2020-09-02: disclosed