Backdoor injected to NPM express-cookies package

[ekke]

Remote code injection vulnerability wild in public npm package, plausible-sounding 'express-cookies' and its dependency 'getcookies'. >10K downloads during April.

Vulnerable code: https://npm.runkit.com/getcookies/test/harness.js?t=1525249320108

https://www.npmjs.com/package/express-cookies

[jononor]

No links to git repo in the packages, big warning sign.

[seanwhitsell]

Suspiciously good looking profile pic for the developer too; https://www.google.com/search?tbs=sbi:AMhZZite6RvKwDFjIobMX-...

[mindcrash]

Because it's a crop from a stock photo with a male model (in fact, see the first image result on the page).

[jononor]

Can someone explain how the injection itself works? I assume it's the require doing the work, but its not so clear how that loads externally instead of from a path in filesystem?

[ekke]

NPM guys explain it in the blog today: https://news.ycombinator.com/item?id=16975025

[jononor]

Corrected URL to blogpost is: https://blog.npmjs.org/post/173526807575/reported-malicious-...

[dylz]

It appears to be middleware that looks at headers, and if a certain condition is met, it'll basically execute https://nodejs.org/api/vm.html#vm_vm_runinthiscontext_code_o... against whatever the header has.

[chrbp]

I am curious to know whether you reported it to npm upon your findings. npm questioned me for who to credit on this matter, and they would like to know who the original finder was.

[ekke]

And NPM took it down quickly, whew.

[lucfranken]

did you report it to NPM?

[chrbp]

I don't know how many reported it to npm, but when I initially saw the post on HN, I took the steps to report the packages.

I don't know who to credit on this, and neither does npm but OP seems to be the source of these findings, although it would baffle me if they didn't report it to npm.

[ekke]

Sure, and at least few more people :)

[cathhhhji]

There is no reason to use "express-cookies" when "cookie-parser" exists.

[hinkley]

Express just ejected a bunch of its functionality into “express-“ modules.

[Aspyre]

Am I the only one that's only reading the comments after seeing the first two words of the title?