Executive brief
superhappyfuntime is a npm package that contains malicious code designed to establish unauthorized remote access to infected systems. Any computer running this package should be considered fully compromised, with all credentials and secrets immediately revoked from a clean system. The package executes a reverse shell, potentially granting attackers complete control over affected infrastructure.
Technical details
The vulnerability is a malicious payload intentionally injected into all versions of the superhappyfuntime npm package (CWE-506: Embedded Malicious Code). The malicious code automatically downloads and executes a script that establishes a reverse shell connection, granting an attacker shell-level access to the compromised system. No authentication or user interaction is required—exploitation occurs automatically upon package installation or import. The attack is network-accessible and affects all versions from 0.0.0 onward. Removal of the package does not guarantee removal of all implanted malware, as the attacker may have already achieved persistent code execution on the system.
Affected products
- superhappyfuntime superhappyfuntime all versions
Timeline
- 2020-09-03: disclosed