Executive brief
mysql-koa is a Node.js library that provides MySQL database connectivity for web applications. The package contained malicious code that collected and exfiltrated sensitive system information (OS details, hostname) to a remote server, providing attackers with reconnaissance data about affected systems.
Technical details
This is a supply-chain attack (CWE-506: Embedded malicious code) where the mysql-koa npm package was compromised to include malicious code. The malicious payload automatically collected system metadata (OS and hostname information) and transmitted it to an attacker-controlled remote server without user knowledge or consent. Attack vector is network-based and requires only installation of the affected package version. The compromise affected all users who installed the malicious package version. The recommended mitigation is immediate removal of the package from all environments.
Affected products
- npm mysql-koa
Timeline
- 2020-09-03: disclosed