Executive brief
smartsearchwp is a JavaScript package that contains malware designed to steal user credentials (usernames and passwords) from websites and upload them to a remote server. The malware also attempts to scan the local network gateway and execute arbitrary commands sent from the attacker's server. Although the malicious code contains implementation bugs that limit its effectiveness, removing this package from any website or application is critical to prevent data breaches and unauthorized access.
Technical details
The smartsearchwp package (all versions) contains malicious code classified as CWE-506 (embedded malware). The malware operates by traversing DOM elements to identify credential fields, exfiltrating captured data to a remote server, performing local network reconnaissance via port-scanning, and fetching and executing arbitrary commands via eval(). The attack vector is network-based and requires the malicious TypeScript code to be transpiled and loaded in a web browser context; it does not execute on package installation or require(). While the npm security team identified several implementation flaws in the malware that reduce its practical impact, the presence of intentional malicious functionality means complete removal is the only safe remediation.
Affected products
- npm smartsearchwp all versions
Timeline
- 2020-09-03: disclosed