GHSA-9wgc-5pgr-25p3: Malicious code in skillward (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (6c3ad90106c904f14f7b4987775b3e5701d66fc6ca669f4de658dd442bfb9f61) skillward ships a set of lint/scan rules under dist/rules/ that detect suspicious patterns in other code. SW003-encoded-payload.js contains detection logic that references Buffer.from/base64 decoding patterns as things to flag; SW007-suspicious-egress.js enumerates dynamic-DNS provider substrings (no-ip., hopto.org, duckdns) as indicators to match against scanned code. These strings appear as detection data inside a rules module, not as runtime behavior of the package itself: the package does not decode or execute any base64 payload, does not contact dynamic-DNS hosts, and has no install-time or import-time network, filesystem, or credential activity. The pattern matches the indicator-as-data shape of a defensive detection tool.
Source: ghsa-malware (b0f3fd922178c06b3eae3dfaaa0bce1469e7c2d70a010a6263b117e36874a72a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
skillward (npm)from your environment.Remove the skillward package from any computer where it is installed or running; removal may not eliminate all malicious software resulting from the installation.
- Operational
Rotate all secrets and keys stored on any affected computer immediately, using a different computer.
Event History
Frequently Asked Questions
Does the reported base64 decoding and dynamic-DNS content mean the package performs those actions?
The available source analysis says these strings are detection data in lint/scan rules under dist/rules/, rather than runtime behavior. It states that the package does not decode or execute a base64 payload, contact dynamic-DNS hosts, or perform install-time or import-time network, filesystem, or credential activity.
Which package releases are referenced by the advisory?
The references include npm package pages for skillward versions 0.1.1 and 0.1.2. No affected-version range is provided in the available data.
What response does the malware advisory source recommend for installed systems?
That source says any computer with the package installed or running should be treated as fully compromised. It recommends rotating all secrets and keys from a different computer immediately.