Executive brief
The mogobd npm package was found to contain malicious code designed to collect and exfiltrate sensitive system information including OS details and hostname to an attacker-controlled remote server. This poses a direct risk to any system that installs this package, as it could expose infrastructure details and provide attackers with reconnaissance data for further compromise.
Technical details
The mogobd npm package contained intentionally injected malicious code (CWE-506: Embedded Malicious Code) that executed upon installation or runtime. The payload automatically collected system information such as OS type and hostname, then transmitted this reconnaissance data to a remote attacker-controlled server. Since this is a published npm package with network reachability, no authentication or user interaction is required beyond the initial package installation. The attack achieves information disclosure and provides attackers with system profiling data for targeting follow-up attacks. The remediation is immediate removal of the package from all affected environments.
Affected products
- npm mogobd 0.0.0+
Timeline
- 2020-09-03: disclosed: Malicious package advisory published
- 2020-08-31: other: Reviewed by GitHub Security Lab