Executive brief
The npm package 'froever' is a malicious library designed to infect systems when users accidentally mistype the name of a legitimate package during installation. Once installed, it automatically executes code that opens a backdoor, giving attackers full control over the affected computer. This can lead to the theft of sensitive data, credentials, and permanent compromise of the local environment.
Technical details
The 'froever' package is a typosquatting malware targeting npm users. It utilizes a 'preinstall' script in its package.json to automatically execute malicious commands upon installation. The script downloads a secondary payload from a remote server and executes it to establish a persistent backdoor. This allows for unauthenticated remote code execution (RCE) and full system compromise. Because the malware executes with the privileges of the user running the npm install command, all local secrets, environment variables, and files should be considered compromised.
Affected products
- npm froever All versions
Timeline
- 2020-08-31: disclosed: GitHub reviewed the advisory
- 2020-09-02: advisory: Advisory published