Executive brief
A malicious package named 'nodes.js' was discovered on the npm registry, designed to impersonate legitimate Node.js tools. When installed, it automatically downloads and installs thousands of other packages to exhaust the system's memory and storage. This can lead to a complete denial of service, system instability, and potential unauthorized changes to the development environment.
Technical details
The 'nodes.js' package is a malicious library (CWE-506) distributed via the npm registry. Upon installation, it executes a script that searches for and globally installs thousands of packages based on popular keywords such as 'node', 'react', 'vue', and 'angular'. This behavior is intended to fill the host system's memory and disk space, leading to a denial-of-service (DoS) condition. The attack requires no authentication and is triggered automatically during the package installation process. Users are advised to remove the package immediately and audit their global npm installations for unauthorized software.
Affected products
- npm nodes.js All versions
Timeline
- 2020-08-31: advisory: GitHub reviewed the advisory
- 2020-09-03: disclosed: Advisory published