Executive brief
rate-map is a JavaScript/Node.js utility library. Version 1.0.3 was found to contain malicious code that targets and sabotages the purescript-installer package by rewriting its dl-tar dependency, potentially breaking downstream build processes and compromising developer environments that use this infected version.
Technical details
This is a supply-chain attack via malicious package injection (CWE-506: embedded malicious code). Version 1.0.3 of the rate-map npm package contains code intentionally designed to modify the dl-tar dependency used by purescript-installer. The attack requires no authentication or special privileges; any developer who installs or updates to the compromised version is affected. An attacker can achieve code execution in the victim's build environment and compromise downstream projects. The vulnerability was patched in version 1.0.5 and later.
Affected products
- npm rate-map 1.0.3
Timeline
- 2020-09-03: disclosed
- 2020-09-03: patched: Fixed in version 1.0.5 and later