Executive brief
rpc-websocket is a JavaScript library used for WebSocket-based remote procedure calls. Versions 0.7.6 and later contained malicious code that opens a backdoor, allowing attackers to execute arbitrary commands on affected systems. Any computer with a compromised version installed should be considered fully compromised and requires immediate remediation including credential rotation and complete system cleanup.
Technical details
This vulnerability (CWE-506: Embedded Malicious Code) involves intentional malicious code embedded directly in the rpc-websocket npm package starting at version 0.7.6. The malicious code establishes a backdoor connection to a remote server, granting an attacker arbitrary command execution capabilities on the host machine. No authentication or user interaction is required; the backdoor activates upon package installation or when the module is loaded. Any system running a compromised version should be treated as fully compromised, with no guarantee that simple package removal will eliminate all malicious artifacts.
Affected products
- rpc-websocket rpc-websocket 0.7.6 and later
Timeline
- 2020-09-03: disclosed: Malicious package advisory published
- 2020-08-31: other: GitHub reviewed advisory