Executive brief
The m-backdoor npm package contains intentional malicious code that downloads and executes arbitrary files during installation. This allows attackers to run unauthorized code on any developer's or user's system that installs the package, potentially compromising build systems, stealing credentials, or deploying ransomware or other malware.
Technical details
The vulnerability is a supply-chain attack implemented via malicious pre-install scripts embedded in the package. All versions of m-backdoor are affected. During npm installation, the malicious preinstall script downloads a remote payload and executes it with the privileges of the installing user. The initial observed payload defaced websites by manipulating the DOM, but the capability exists to execute arbitrary code, making this a critical remote code execution vector. No patch is available; the only remediation is complete package removal.
Affected products
- npm m-backdoor all versions
Timeline
- 2020-09-03: disclosed