Executive brief
The loadyaml npm package contained malicious code that executed during installation. When installed, the package ran a preinstall script that extracted and publicly posted sensitive system information (IP address, geolocation, home directory, username) to GitHub, exposing users' personal and network details.
Technical details
The vulnerability is a code injection / malicious payload embedded in the npm package's preinstall hook (CWE-506). The attack vector is installation-time execution: when a developer or CI/CD system installs the compromised package version, the preinstall script automatically executes without user action, collecting system metadata (IP, geolocation, home directory, username) and posting it as a public comment on GitHub. No authentication bypass or special privileges are required—the attack succeeds simply by running npm install. The affected versions include 0 through 1.0.2; the package has been removed from the npm registry and the leaked data purged from GitHub.
Affected products
- npm loadyaml 0 through 1.0.2
Timeline
- 2020-10-01: disclosed