Executive brief
rimrafall is a malicious npm package version 1.0.0 that contains destructive code disguised as a preinstall script. When installed, the package attempts to delete all files in the system's root folder, effectively destroying the entire filesystem. Any user who installed this package likely suffered complete data loss and system destruction.
Technical details
The vulnerability is a malicious package injection attack (CWE-506: Embedded Malicious Code). rimrafall version 1.0.0 contains a preinstall script that executes automatically when the package is installed via npm, before any user code runs. The script is designed to recursively remove all files from the system root directory, causing catastrophic data loss and system unavailability. The attack vector is network-based (installation from the npm registry) with no privileges or user interaction required beyond the install command. There is no patch available; the only remediation is to avoid installing this package and remove it immediately if already present.
Affected products
- npm rimrafall 1.0.0
Timeline
- 2020-09-02: disclosed