Executive brief
The npm package node-ftp was compromised and contained malicious code that exfiltrated system information (OS details and hostname) to a remote server. An attacker could use this compromised package to gather reconnaissance data from any developer or system that installed it. This represents a supply chain attack where a trusted dependency could be used to spy on development environments or production systems.
Technical details
This vulnerability is classified as malicious code injection (CWE-506). The node-ftp package was uploaded to npm with malicious functionality that collects and sends system information (OS name/version and hostname) to an attacker-controlled remote server without user consent. The attack vector is network-based, as any developer or system installing the package would automatically execute the malicious code during installation or use. No authentication is required—the malicious payload executes upon package installation or runtime. An attacker could gain valuable reconnaissance data about affected systems including their operating system and network identity. The mitigation is to remove all versions of the compromised package from affected environments immediately.
Affected products
- npm node-ftp all versions
Timeline
- 2020-09-03: disclosed: Malicious package disclosed in GitHub Advisory Database
- 2020-08-31: other: GitHub security team reviewed and confirmed malicious content