Executive brief
The only-test-not-install npm package contains malicious code that executes during installation. When installed, the package runs a postinstall script that deletes the ~/test directory from the user's system, resulting in potential data loss and system disruption.
Technical details
This is a malicious package attack (CWE-506: Embedded Malicious Code) where the package includes harmful code in its postinstall script. All versions of only-test-not-install are affected. The attack is triggered automatically during package installation with no user interaction or authentication required, as npm postinstall scripts execute with the installer's privileges. The malicious script targets and deletes the ~/test directory. The primary mitigation is immediate removal of the package from affected environments.
Affected products
- npm only-test-not-install all versions
Timeline
- 2020-09-03: disclosed