Executive brief
node-spdy is a Node.js library that implements the SPDY networking protocol used in web applications. A malicious version of this package was published that secretly collected and transmitted system information (OS and hostname) to a remote server. Developers who installed the compromised package may have exposed sensitive system details and should immediately remove it from their environments.
Technical details
This vulnerability involves a malicious package (CWE-506: Supply Chain Compromise) uploaded to npm. The compromised node-spdy package contained embedded code that enumerated system information including the operating system and hostname, and transmitted this data to an attacker-controlled remote server. The malicious payload executed automatically upon package installation or import. No authentication or user interaction is required for exploitation—the attack occurs passively during the installation and runtime phases. There is no patch for this malicious package; users must remove all affected versions entirely and switch to a known-good source or alternative library.
Affected products
- npm node-spdy all versions
Timeline
- 2020-09-03: disclosed: Malicious package disclosed in GitHub Advisory Database