Executive brief
Version 1.0.0 of the require-port npm package contains malicious code that executes during installation, designed to trick developers into installing it via typosquatting. The malware downloads and executes a remote payload, establishing a backdoor that grants attackers full control of the affected system. Any machine with this package installed should be considered fully compromised, and all credentials and secrets must be rotated from a separate trusted system.
Technical details
The require-port npm package version 1.0.0 contains a malicious preinstall script (CWE-506) that executes with user privileges during package installation. The attack exploits typosquatting—users who mistype the package name during npm install trigger the malware instead of the legitimate module. Upon installation, the script downloads and executes arbitrary code from a remote server, establishing a backdoor that grants complete system access to the attacker. No patch is available for this intentionally malicious package; the only mitigation is complete removal and system remediation. Full system compromise should be assumed; removing the package alone does not guarantee removal of all backdoors or persistent malware installed by the initial payload.
Affected products
- npm require-port 1.0.0
Timeline
- 2020-09-03: disclosed
- 2020-08-31: other: GitHub security team reviewed advisory