Executive brief
sj-tw-test-security is a JavaScript package distributed via npm that contains malicious code. The package downloads and executes a script that establishes a reverse shell, granting an attacker complete control over the compromised system. Any system with this package installed should be considered fully compromised and all credentials stored on it must be rotated immediately from a different device.
Technical details
This npm package contains malicious code (CWE-506: Embedded Malicious Code) that automatically downloads and executes a reverse shell script when the package is installed or run. The attack vector is network-based with no authentication or user interaction required—execution occurs automatically as part of the package installation/initialization process. A successful installation grants the attacker arbitrary code execution and full system control. The malware affects all versions from 0.0.0 onwards; removal of the package alone cannot guarantee removal of all deployed malware since the attacker has already obtained code execution privileges.
Affected products
- npm sj-tw-test-security all versions
Timeline
- 2020-09-03: disclosed