Executive brief
mogodb is a JavaScript package available on npm. A malicious version of this package was published that contained code to exfiltrate sensitive system information (OS type, hostname) to a remote server. Any developer or application using this compromised version would have their system details exposed and sent to an attacker-controlled server.
Technical details
This npm package contained intentionally malicious code (CWE-506) that exfiltrated system information including OS type and hostname to a remote attacker-controlled server. The vulnerability requires no user interaction or authentication—simply installing and running the package triggers the malicious behavior. The attack vector is network-based with low complexity and no privilege requirements. An attacker who published this malicious package achieved information disclosure of system configuration details from affected systems. Recommendation is to immediately remove this package from all environments.
Affected products
- npm mogodb 0.0.0 and potentially others
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory: GitHub reviewed