Executive brief
The npm package 'rrgod' has been identified as malicious software. If installed, it automatically downloads and runs unauthorized scripts that can give an attacker full control over the computer or server. This could lead to the theft of sensitive data, such as passwords and company secrets, or the complete disruption of business operations.
Technical details
The 'rrgod' package is classified as malware (CWE-506) and contains malicious pre-install, post-install, and install scripts. Upon installation via a package manager like npm, the library automatically fetches an external file from a remote server and executes its contents. This allows for unauthenticated remote code execution (RCE) on any system where the package is included as a dependency. The package has been removed from the npm registry, and any systems where it was previously installed should be treated as fully compromised.
Affected products
- npm rrgod All versions
Timeline
- 2020-08-31: advisory: GitHub reviewed the advisory
- 2020-09-02: disclosed: Advisory published