Executive brief
uglyfi.js is a JavaScript library distributed via npm. Version 0.17.3 was compromised with malware that executes automatically during installation, downloading and running additional malicious code that grants attackers full control of the system. Any system with this version installed should be considered fully compromised and all credentials should be rotated immediately from a clean machine.
Technical details
The vulnerability is a trojanized npm package (CWE-506: embedded malicious code). The attack vector is installation via npm package manager—no special preconditions are required beyond the user installing the package. The malware is delivered as a preinstall script, which runs automatically during `npm install`. Upon execution, it downloads additional malware from a remote server, executes it, and establishes a backdoor, giving the attacker arbitrary code execution and system control. No patch is available; the package should be removed and the system completely rebuilt as the backdoor may persist after removal.
Affected products
- npm uglyfi.js 0.17.3
Timeline
- 2020-09-03: disclosed: Malicious version 0.17.3 published to npm