Executive brief
my-very-own-package is a JavaScript library available on npm. All versions contain malicious code that executes during package installation, exfiltrating system information (Node.js version, CPU architecture, and operating system details) to a remote attacker-controlled server. This provides attackers with reconnaissance data on compromised systems and represents a supply-chain attack vector.
Technical details
The vulnerability is classified as malicious code (CWE-506) embedded in the package's postinstall script. During npm install, the package executes arbitrary code that collects and sends process.versions, process.arch, and process.platform to a remote server. The attack vector is network-based and requires no user interaction beyond installing the package; any developer or CI/CD pipeline using this dependency is compromised. The attacker gains system reconnaissance data and a foothold for potential further compromise. Mitigation requires immediate removal of the package from all environments.
Affected products
- npm my-very-own-package all versions
Timeline
- 2020-09-03: disclosed