Executive brief
npm package 8.9.4 versions 1.0.2 through 1.0.5 contain malicious code embedded in preinstall scripts that runs automatically when the package is installed. The malicious code attempts to read and exfiltrate SSH keys from the system, which could enable attackers to gain unauthorized access to servers and services protected by those credentials.
Technical details
This is a supply chain attack leveraging a malicious npm package (CWE-506: Embedded Malicious Code). The malicious preinstall script executes with the privileges of the installing user at package installation time, without requiring authentication or user interaction. The script specifically targets SSH private keys on the system for exfiltration. While the initial discovery found no evidence of successful data transmission to remote servers, the mere presence of the malicious code and its capability to read sensitive credentials represents a critical risk. The recommended mitigation is to immediately uninstall and remove the affected versions from the environment.
Affected products
- npm 8.9.4 1.0.2, 1.0.3, 1.0.4, 1.0.5
Timeline
- 2020-09-03: disclosed