Executive brief
The npm package 'electorn', a typosquatting attempt of the popular Electron framework, was found to contain malicious code. When installed, the package automatically exfiltrates sensitive system information, including the user's IP address, geolocation, and local directory names, by posting them publicly to GitHub. This poses a significant privacy risk and could be used to profile developers or corporate environments for further attacks.
Technical details
The 'electorn' package (and the related 'loadyaml' package) contains a malicious preinstall script, a common technique in supply chain attacks. Upon execution during the npm install process, the script gathers the host's IP address, IP-based geolocation data, home directory name, and local username. This data is then exfiltrated by programmatically posting it as a public comment on GitHub. The package has been removed from the npm registry, and the leaked data has been scrubbed from GitHub. This is classified under CWE-506 (Embedded Malicious Code).
Affected products
- npm electorn All versions up to 10.0.0
Timeline
- 2020-10-01: advisory: GitHub Advisory published
- 2020-10-01: patched: Package removed from npm registry