Executive brief
luna-mock is a Node.js library package published on npm that was compromised with malicious code. Any system with this package installed is fully compromised—the malicious code exfiltrates system information, downloads and executes arbitrary code from a remote server. Administrators must treat all affected systems as completely compromised, immediately rotate all secrets and keys from a clean system, and perform forensic analysis to identify other malware that may have been installed.
Technical details
luna-mock is an npm package containing deliberately injected malicious code. The vulnerability is a supply-chain compromise (CWE-506: Embedded Malicious Code). Upon installation or execution, the package uploads system information to attacker-controlled servers, downloads additional payloads, and executes arbitrary code with the privileges of the Node.js process. No authentication or special preconditions are required; the malicious behavior is triggered automatically during package installation or module load. Complete system compromise is the result, providing an attacker with persistent code execution and the ability to install additional malware. The only mitigation is removal of the package, though this provides no guarantee of removing malware already deployed.
Affected products
- npm luna-mock all versions
Timeline
- 2020-09-03: disclosed: Malicious code discovered and advisory published