Executive brief
The "momen" package is a malicious npm library that impersonates a legitimate, popular JavaScript package through typosquatting. When installed, the package phones home to a remote server with information about the developer's environment (Node version, sudo privilege status) and details about the misnamed package. While this version does not include additional malware payload, it represents a supply-chain attack vector that compromises developer privacy and could be used for reconnaissance.
Technical details
This is a typosquatting attack (CWE-506) where a malicious npm package uses a name similar to a legitimate, widely-used package to trick developers into installing it by mistake. Upon installation, the package exfiltrates metadata to a remote server, including the intended package name, downloaded package name, Node.js version, and whether the process has sudo privileges. The attack requires only that a developer type the package name incorrectly during installation; no special preconditions or authentication are needed. The attacker gains visibility into developer environments and can use this telemetry for targeting or reconnaissance. The fix is removal of the package from dependencies and verification of package names before installation.
Affected products
- npm momen all versions
Timeline
- 2020-09-02: disclosed