Executive brief
require-ports is a Node.js utility library available on npm. A malicious version (10.4.0) was published that executes arbitrary code during installation, downloads and runs a backdoor, and opens unauthorized remote access to affected systems. Any computer running this package should be considered fully compromised and all credentials must be rotated from a clean machine.
Technical details
The vulnerability is a trojanized package containing malicious preinstall script code. The attack vector is supply-chain poisoning via the npm registry: the malicious code executes automatically with user privileges during package installation (npm install), requiring no authentication or user interaction beyond the install command itself. The malware downloads and executes a remote payload, establishing a backdoor for full system compromise. No patches are available; the affected version (10.4.0) must be avoided entirely and the package removed.
Affected products
- npm require-ports 10.4.0
Timeline
- 2020-09-02: disclosed
- 2020-08-31: advisory: GitHub security advisory reviewed