Executive brief
The malicious-do-not-install npm package contains intentional malicious code that extracts system credential files when installed. Upon execution, it copies sensitive authentication data (/etc/passwd and /etc/shadow) to temporary files accessible to attackers, potentially exposing user credentials and enabling unauthorized system access or privilege escalation attacks.
Technical details
This is a supply-chain attack via a deliberately malicious package published to the npm registry (CWE-506: Embedded Malicious Code). The vulnerability affects all versions of malicious-do-not-install. When installed, the package reads /etc/passwd and /etc/shadow during installation or execution and copies them to /tmp/ where they can be accessed by other processes or attackers with local access. No authentication or special preconditions are required; the malicious behavior executes automatically. The attack vector is local but can enable privilege escalation or credential theft. No patch is available; complete removal of the package is required.
Affected products
- npm malicious-do-not-install all versions
Timeline
- 2020-09-03: disclosed
- 2020-09-03: advisory