Executive brief
A fake npm package named "asnyc" was published to typosquat the popular "async" library. The malicious package tracked users who installed it, collecting and uploading information including the package names, Node version, and whether the process ran with elevated privileges. Organizations using this package inadvertently exposed their development environment details to an attacker-controlled server.
Technical details
This vulnerability is a supply-chain attack via typosquatting (CWE-506). The malicious package "asnyc" mimicked the legitimate "async" library name to trick developers into installing it instead. Upon installation, the package collected sensitive metadata including the package name intended by the developer, the actual package downloaded, the Node.js version, and sudo privilege status, then exfiltrated this data to a remote server. No further compromise occurred beyond reconnaissance data collection. The attack required only that a developer make a simple typo during package installation; no authentication or user interaction beyond installation was needed. Remediation requires removing the package from all dependencies and verifying correct package names during future installations.
Affected products
- npm asnyc all
Timeline
- 2020-09-02: disclosed
- 2020-08-31: advisory: GitHub reviewed the advisory