Executive brief
The serializes npm package contained malicious code that collected and exfiltrated system information (operating system type, hostname) to a remote server without user knowledge. This compromises system visibility and provides attackers reconnaissance data that can facilitate further attacks or network mapping.
Technical details
The serializes npm package (all versions from 0.0.0 onwards) contained intentional malicious code that captured OS and hostname information and transmitted it to an attacker-controlled remote server. This represents a supply-chain attack vector via package repository poisoning (CWE-506: Embedded Malicious Code). The attack is trivially exploitable at installation time with no authentication or user interaction required; any system installing the package automatically executes the malicious code. The vulnerability has been mitigated by removal from npm; there are no publicly known patches as the package itself was compromised.
Affected products
- npm serializes all versions from 0.0.0 onwards
Timeline
- 2020-09-03: disclosed: GHSA published