Executive brief
The serilize npm package contained malicious code that collected and exfiltrated system information (OS type, hostname) to a remote server. This supply-chain compromise could give attackers reconnaissance data about affected systems or serve as a foothold for further attacks. Organizations should immediately remove this package from development and production environments.
Technical details
This npm package contained injected malicious code (CWE-506: Embedded Malicious Code) that performed unauthorized information gathering. The attack vector is network-based and requires no user interaction—malicious behavior was triggered automatically upon package installation or use. The code exfiltrated OS and hostname information to an attacker-controlled server, enabling reconnaissance. No patch for this package exists; the only remedy is removal and replacement with a legitimate alternative or manual code audit and remediation.
Affected products
- npm serilize all
Timeline
- 2020-09-03: disclosed: Malicious package published and disclosed