Executive brief
The yeoman-genrator package (a typosquatting attack on the legitimate "yeoman-generator" module) contains malicious code that executes during installation. When installed, it downloads and runs arbitrary code from a remote server, establishing a backdoor on the victim's machine. Any system with this package installed should be considered fully compromised and all credentials stored on that machine must be rotated immediately.
Technical details
This is a malicious package attack (CWE-506: Embedded Malicious Code) targeting users who mistype the legitimate yeoman-generator package name. Version 3.1.1 contains a malicious preinstall script that automatically executes during npm install, before the package contents are inspected. The script downloads and executes a payload from a remote server, giving an attacker full control of the system. The attack requires no authentication or user interaction beyond attempting to install the package; it succeeds simply due to typosquatting. The primary defense is package removal, but since full system compromise has likely occurred, no guarantee exists that removing the package eliminates all malicious artifacts.
Affected products
- npm yeoman-genrator 3.1.1
Timeline
- 2020-09-02: disclosed