Executive brief
A malicious npm package named "sonatype" was distributed through the npm package registry before being removed. Any system that installed this package should be considered fully compromised, as it granted an attacker complete control over the affected computer. Organizations must rotate all credentials and keys stored on compromised systems and perform full forensic analysis to determine what additional malware may have been installed.
Technical details
The package sonatype is a trojanized npm module that achieves remote code execution and system compromise. The attack vector is installation via npm, typically through dependency resolution or direct installation by a developer. Once installed, the malicious code executes in the context of the Node.js runtime and the user account running npm, allowing the attacker to steal secrets, install persistent backdoors, and exfiltrate sensitive data. The package was published to the npm public registry and later removed. No patch exists; complete package removal and system remediation are required, though full cleanup is not guaranteed due to the level of access gained.
Affected products
- npm sonatype 0.0.0
Timeline
- 2021-01-29: disclosed
- other: Package removed from npm registry