Executive brief
The secure_identity_login_module npm package contains intentionally malicious code that collects system information and transmits it to a remote attacker-controlled server, then downloads and executes arbitrary code on the affected system. Any system with this package installed should be considered fully compromised, and all credentials, secrets, and cryptographic keys stored on that machine must be rotated immediately from a clean, separate device.
Technical details
This npm package (secure_identity_login_module) is a deliberately malicious supply-chain attack artifact containing embedded malware (CWE-506: Embedded Malicious Code). The malware performs system reconnaissance by uploading host information to an attacker-controlled remote server, then downloads and executes additional arbitrary code with the privileges of the npm installation process (typically the installing user's privileges). The attack vector is local at installation time (user runs npm install) but results in remote code execution capabilities. All versions of the package are affected. No patch exists because the maliciousness is intentional; the only mitigation is complete package removal and full system compromise assessment.
Affected products
- npm secure_identity_login_module all
Timeline
- 2020-09-03: disclosed: Vulnerability published to OSV and npm advisories