Executive brief
The regenraotr package is a malicious npm library distributed as a typosquatting attack, targeting developers who mistype package names during installation. Once installed, it connects to an attacker-controlled server and executes arbitrary commands, potentially giving attackers complete control of the developer's machine and access to all credentials and source code stored there.
Technical details
This is a malware package (CWE-506) published to the npm registry that abuses typosquatting—intentionally similar naming to popular packages. The vulnerability is remote code execution: upon installation and execution, the package performs a callback to an external command-and-control (C2) server to download and execute arbitrary commands. The attack vector is network-based and does not require authentication or user interaction beyond the initial npm install command. An attacker gains full remote code execution capability on the victim's machine. The package was rapidly removed from npm registry but affected all published versions.
Affected products
- npm regenraotr all
Timeline
- 2020-09-01: disclosed