Executive brief
A package named yeoman-genrator, which appears to be a typosquatted variant of the legitimate Yeoman code generator tool, was found to contain malicious code. When installed, the package executes a preinstall script that downloads and runs arbitrary code from a remote server, potentially giving attackers complete control of the developer's machine. Any system where this package was installed should be considered compromised and all secrets, credentials, and keys should be rotated immediately from a different, clean machine.
Technical details
This malware exploits the npm install process by embedding malicious code in the preinstall script, which executes automatically before the main package installation completes. The vulnerability is a form of supply-chain attack (CWE-506: Embedded Malicious Code). The package leverages typosquatting—registering a name similar to a legitimate package (yeoman-generator)—to trick developers into installing it via typing mistakes. The preinstall script downloads and executes a remote payload, establishing a backdoor and granting full system access to attackers. The attack vector is network-based and requires only that a user attempt to install the malicious package; no authentication or user interaction beyond the install command is needed. There is no patch available; the only remediation is complete removal and system remediation.
Affected products
- npm yeoman-genrator 2.0.2 and potentially other versions
Timeline
- 2020-09-03: disclosed: Malicious package disclosed in OSV database
- 2020-08-31: advisory: GitHub-reviewed advisory published