Executive brief
retcodelog is an npm package library used by developers in their applications. All versions of this package contain malicious code that exfiltrates sensitive system information to remote servers, downloads and executes arbitrary code on infected systems. Any system running this package should be considered fully compromised, with all credentials and keys rotated immediately.
Technical details
The retcodelog npm package contains embedded malicious code classified as CWE-506 (embedded malicious code). The attack vector is network-based with no authentication or user interaction required—the malicious payload executes upon package installation or import. The malware performs system reconnaissance by uploading host information to an attacker-controlled server, then downloads and executes arbitrary binaries with the privileges of the running process. Since the package reached the npm registry, any developer or CI/CD system installing this library without pinning specific versions became compromised. No patch is available; the only mitigation is complete removal and remediation of affected systems.
Affected products
- npm retcodelog all versions
Timeline
- 2020-09-03: disclosed: Advisory published on GitHub