Horizon Alert
Summary of the vulnerability and why it matters
A security issue was discovered in a React hook for managing context, where malicious code could be executed on developer machines during the installation process. This occurred through compromised commits that were later removed but could persist in local copies of the code. The vulnerability was designed to target developer workstations and bypass security checks in CI/CD environments.
- Malicious code executed during installation on developer machines.
- Targeted developer workstations, not deployed applications.
- Confirm relevance and exposure in development environments.
Attack Path
How an attacker could exploit the issue
Attackers could compromise developer machines by injecting malicious code through a compromised package installation process. This attack starts when a developer clones a repository or uses a direct SHA URL containing malicious commits that alter the package's installation script. When `npm install` is run, it fetches and executes arbitrary code from an attacker-controlled server, potentially leading to a full compromise of the developer's machine.
- Requires local repository clone.
- Triggers via `npm install` script.
- Results in full machine compromise.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could affect developer machines when they install the package from a compromised source. The malicious commits could lead to remote attacker-controlled code execution on these machines during the installation process.
- Developer machine code execution.
- Running `npm install` on affected code.
- Full compromise of the machine.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability impacts developer workstations through malicious commits to a userland React hook's default branch. The initial compromise occurs during `npm install` on affected local clones or forks, allowing remote code execution. The primary concern is the potential for full compromise of developer machines and any systems or credentials accessible from them.
- Ownership: Application developers and security teams.
- Verify: Affected local repository clones and developer machines.
- Action: Rotate credentials and clean compromised machines.
