Horizon Alert
Summary of the vulnerability and why it matters
A security issue was found in a development tool that could allow attackers to run malicious code on developer machines during software installation. This occurred through compromised code commits that were later removed, but could still be present in local copies of the software.
- Malicious code execution during developer installations.
- Confirms developer machine compromise and credential rotation.
- Verify if development tools were exposed.
Attack Path
How an attacker could exploit the issue
An attacker could compromise a developer's machine by tricking them into installing a malicious version of a package that fetches and executes arbitrary code. This malicious code could lead to the full compromise of anything reachable by the Node.js process with the user's permissions.
- Requires developer to install malicious package.
- Triggered by `npm install` on affected checkout.
- Risk of full machine compromise.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could affect developer workstations, allowing remote attackers to execute code when `npm install` is run on a compromised code checkout. The malicious code can fetch and execute payloads from attacker-controlled servers, potentially leading to a full compromise of anything reachable by the Node process.
- Developer machine code.
- Malicious code executes during `npm install`.
- Full compromise of the developer machine.
Operational Fix
Recommended remediation, mitigation, and detection steps
The `react-tracked` package's default branch was compromised, allowing remote code execution on developer machines during `npm install`. While the malicious commits were removed from the default branch, local clones, forks, or direct SHA URLs might still contain them. The vulnerability specifically targeted developer workstations and was designed to skip execution in CI or cloud environments. Owners of developer machines who ran `npm install` on affected checkouts should treat their machines as compromised and take immediate steps to remediate.
- Owner: Development teams managing local developer environments.
- Verify first: Identify affected local machine checkouts.
- Action: Rotate credentials and clean local clones.
