Executive brief
regenrator is a package published to npm that was designed as malware to trick developers into installing it through typosquatting. When executed, the package connects to a remote command-and-control server and executes arbitrary commands on the affected system, giving attackers complete control over the developer's machine and all credentials stored on it.
Technical details
This is a malicious package (CWE-506: Embedded Malicious Code) published to the npm Registry as a typosquatting attack targeting the popular regenerator package. All versions of regenrator contain malware that phones home to a command-and-control server to fetch and execute arbitrary commands with the privileges of the user running npm. The attack vector is network-based with no authentication required, and the precondition is only that a developer mistypes the package name during installation. Successful exploitation grants the attacker code execution on the developer machine with full access to credentials, source code, and build infrastructure. The package was rapidly removed from npm, but any systems that installed it should be considered fully compromised.
Affected products
- npm regenrator all
Timeline
- 2020-09-01: disclosed