Executive brief
sj-tw-sec is a JavaScript library available on npm that has been deliberately poisoned with malicious code. When installed, the package automatically downloads and executes a script that establishes a reverse shell connection, giving an attacker complete control over the compromised system. Any organization using this package must immediately revoke all secrets, credentials, and authentication tokens, as full system compromise cannot be ruled out.
Technical details
This is a supply-chain attack in which all versions of the sj-tw-sec npm package contain embedded malicious code (CWE-506: Embedded Malicious Code). During installation or execution, the package triggers a script that opens a reverse shell, granting an attacker remote code execution and full control of the affected system. No authentication or user interaction is required beyond the initial package installation. The attack vector is network-based, as the malicious script is fetched and executed automatically. There is no patch available for this package; complete removal is recommended, though full remediation cannot be guaranteed due to the persistent nature of reverse shell compromises.
Affected products
- npm sj-tw-sec all
Timeline
- 2020-09-03: disclosed: Vulnerability published in GitHub Advisory Database