Executive brief
soket.js is a malicious npm package designed to exploit typos when developers install dependencies. Once installed and executed, it contacts a remote Command and Control server to download and execute arbitrary commands on the affected system, giving attackers complete control over the host. Any system with this package installed should be considered fully compromised and requires complete OS reinstallation and credential rotation.
Technical details
This is a supply-chain attack vector: a malicious npm package (typosquatting attack on "socket.js" or similar) containing hardcoded malware that beacons to a remote C2 server upon execution. The vulnerability class is CWE-506 (embedded malicious code). Attack vector is network; no authentication or user interaction is required beyond the initial package installation and execution in a JavaScript environment. The attacker can achieve remote code execution with full system privileges. The package was published briefly to the npm Registry and has been removed; however, any historical installations represent full system compromise.
Affected products
- npm soket.js all versions
Timeline
- 2020-09-01: disclosed: Published to npm Registry
- 2020-08-31: other: GitHub Security Advisory created