Executive brief
tensorplow is a Node.js package distributed through npm. All versions of this package contain malicious code that executes during installation, contacting a remote command-and-control server to download and run arbitrary commands on the infected system. Any computer with this package installed should be considered fully compromised, with all credentials and keys rotated from a different system.
Technical details
The vulnerability is a malicious package (CWE-506: Embedded Malicious Code) distributed via npm. The attack vector is installation-time execution via a preinstall script, requiring no authentication or user interaction beyond the initial package install. When tensorplow is installed, the preinstall script establishes communication with an attacker-controlled command-and-control server, allowing arbitrary command execution on the host system. The attacker gains full control of the compromised machine. There is no patch for this malicious package; the only remediation is removal and complete system reimage/recovery.
Affected products
- npm tensorplow all versions
Timeline
- 2020-09-02: disclosed