Executive brief
wepack-cli is a malicious npm package that impersonated a legitimate webpack utility by using a similar name (typosquatting). When installed, it silently collected and exfiltrated information about the user's environment, including Node version and sudo status, to remote servers. Developers who accidentally installed this package exposed their development infrastructure details and demonstrated the risks of supply chain attacks.
Technical details
This is a malicious package vulnerability (CWE-506: Embedded Malicious Code) in the npm ecosystem. The package wepack-cli typosquatted the legitimate webpack-cli package and, when installed, automatically collected and transmitted metadata to a remote server without user consent or visibility. The attack required only that a developer mistype the package name during npm install—no special privileges, network configuration, or user interaction beyond installation was necessary. The collected data included the package name, intended target, Node version, and whether execution occurred under sudo. The vulnerability affects all versions of the malicious wepack-cli package from version 0 onward; the fix is removal of the package from dependencies.
Affected products
- npm wepack-cli all versions
Timeline
- 2020-09-02: disclosed: Advisory published