Executive brief
The npm package test-module-a contains malicious code that automatically executes during installation. The malicious preinstall script attempts to hijack all npm packages owned by the installing user by adding unauthorized maintainers, potentially giving attackers permanent control over the victim's published packages. This represents a severe supply chain attack vector affecting any developer who installed the compromised package.
Technical details
The vulnerability involves code injection via a malicious preinstall script (CWE-506: Embedded Malicious Code). The attack vector is network-based with no authentication or user interaction required beyond running npm install. During installation, the script enumerates all npm packages owned by the installing user and attempts to add attacker-controlled accounts as additional maintainers to each package. This allows the attacker to modify, republish, or transfer ownership of the victim's packages, effectively compromising the entire package portfolio. All versions of test-module-a are affected; remediation involves immediate package removal and enabling 2FA on npm accounts.
Affected products
- npm test-module-a all versions
Timeline
- 2020-09-11: disclosed: Advisory published