Executive brief
The portionfatty12 npm package is malicious software designed to compromise systems that install it. Upon installation, it automatically exfiltrates the user's SSH private keys to a remote attacker-controlled server, granting unauthorized access to other systems and services the victim can reach. Any system with this package installed should be considered fully compromised and all credentials must be rotated.
Technical details
portionfatty12 is a malicious npm package (CWE-506: Embedded Malicious Code) that executes arbitrary code during installation. The package contains embedded malware that immediately upon install exfiltrates SSH keys (typically from ~/.ssh/ on Unix systems) to an attacker-controlled remote server. No authentication, user interaction, or special preconditions are required—the malicious payload executes with the privileges of the user running npm install. Attack vector is network-based as the malware communicates with external infrastructure. The package has been removed from the npm Registry; however, the advisory recommends treating any system where this package was installed as fully compromised and requiring credential rotation and forensic analysis.
Affected products
- npm portionfatty12 all versions
Timeline
- 2020-09-02: disclosed
- other: Package removed from npm Registry