Executive brief
midway-xtpl is a template engine library for Node.js. All versions contain malicious code that collects system information, downloads and executes arbitrary files from a remote server, effectively giving attackers complete control of any system running the package. Organizations using this library should immediately revoke all secrets and credentials, as systems may be fully compromised.
Technical details
This is a malicious package injection vulnerability (CWE-506) affecting all versions of the npm package midway-xtpl. The embedded malicious code performs reconnaissance by exfiltrating system information to a remote server, then downloads and executes arbitrary code, establishing command and control. No authentication or user interaction is required—the malicious payload executes automatically on package installation or module import. The attack vector is network-based and affects any system with the package installed. There is no patch available; the only remediation is complete removal of the package and rotation of all credentials and secrets from an uncompromised system.
Affected products
- midway xtpl all versions
Timeline
- 2020-09-03: disclosed
- 2020-08-31: other: GitHub reviewed