Executive brief
maybemaliciouspackage is a JavaScript/Node.js library distributed via npm. All versions contain malicious code that executes during installation and exfiltrates SSH keys from the system to an attacker-controlled destination. Installation of this package results in immediate credential theft and potential unauthorized access to systems and services.
Technical details
This vulnerability is a trojanized package (CWE-506: Embedded Malicious Code) distributed on npm. All versions of maybemaliciouspackage contain malicious postinstall script code that executes with the privileges of the user running npm install. The malicious script prints system SSH keys to console output, which can be captured and sent to an attacker. The attack requires no authentication or unusual user interaction—exploitation occurs automatically during the standard package installation process. Mitigation requires immediate removal of the package from all environments.
Affected products
- npm maybemaliciouspackage all versions
Timeline
- 2020-09-03: published