Executive brief
node-buc is a JavaScript package distributed via npm. All versions contain malicious code that collects system information, downloads files from remote servers, and executes them without authorization. Any system with this package installed should be considered fully compromised; all credentials and keys must be rotated immediately from a separate, clean system.
Technical details
node-buc is a malicious npm package (CWE-506: Embedded Malicious Code) that executes arbitrary code during installation or runtime. The package collects system information, exfiltrates it to a remote server, then downloads and executes additional payloads without user consent or knowledge. Attack requires only that the package be installed—no network reachability checks or authentication bypass are needed, as the malicious behavior is embedded in the package itself. An attacker gains full code execution with the privileges of the npm install process and any subsequent node.js process running the package. The only mitigation is complete removal and credential rotation from a clean system; removal alone may not eliminate all malicious artifacts if the downloaded payload has achieved persistence.
Affected products
- npm node-buc all versions
Timeline
- 2020-09-03: disclosed