Executive brief
shrugging-logging is a malicious npm package that executes harmful code during installation. When installed, the package automatically attempts to compromise all npm packages owned by the user by adding unauthorized maintainers, effectively hijacking their account and packages. Organizations using this package face immediate account takeover and loss of control over their npm package portfolio.
Technical details
This package contains embedded malicious code in a postinstall script (CWE-506: Embedded Malicious Code) that executes automatically upon npm installation without requiring authentication or user interaction. The exploit enumerates all npm packages owned by the installing user and attempts to add an attacker-controlled maintainer to each package, enabling package hijacking and supply-chain compromise. No user interaction or elevated privileges are required beyond running npm install; the network-based attack is triggered immediately during package installation. An attacker gains full control over all npm packages maintained by the victim, enabling malware distribution, credential theft, or denial of service. The only mitigation is to remove the package entirely and manually audit all affected npm packages.
Affected products
- npm shrugging-logging all versions
Timeline
- 2020-09-11: disclosed
- 2020-09-11: advisory: GHSA-qv78-398w-cxp7 published