Executive brief
uglyfi-js is a JavaScript library distributed via npm. Version 3.4.6 contains malicious code that executes during package installation, downloading and running arbitrary code from a remote server to establish a backdoor. This is a typosquatting attack—users who mistype package names may install the malware instead, giving attackers full system access and requiring complete system remediation.
Technical details
This is a supply-chain attack using malicious npm package distribution (CWE-506: Embedded Malicious Code). The vulnerability is embedded in version 3.4.6's preinstall script, which executes automatically when npm installs the package, before any user code runs. The attack vector is network-based with no authentication or user interaction required beyond package installation. The malicious script fetches and executes a payload from a remote server, establishing a backdoor and compromising system integrity. Once installed, complete system compromise must be assumed and all credentials and keys should be rotated from a different device.
Affected products
- npm uglyfi-js 3.4.6
Timeline
- 2020-09-02: disclosed