Executive brief
saync is a malicious npm package that impersonated a legitimate package of similar name (typosquatting). When installed, the package tracked users and reported system information to a remote server, including package names, Node version, and whether the process had sudo privileges. This allows attackers to identify and profile development environments that mistakenly installed the wrong package.
Technical details
The vulnerability is a malicious package (CWE-506) distributed via npm that uses typosquatting to trick users into installation. All versions of saync exfiltrated telemetry data including the installed package name, the intended package name, Node.js version, and sudo privilege status to a remote server. No further system compromise was achieved beyond the information disclosure. The attack vector is network-based and requires user action (installing the package with an incorrect name), with no authentication or special privileges required. Mitigation involves removing the package from dependencies and verifying correct package names during installation.
Affected products
- npm saync all versions
Timeline
- 2020-09-02: disclosed: Advisory published