Skip to content

Malicious Package in destroyer-of-worlds

critical severity GitHub Reviewed Published Sep 2, 2020 • Updated Sep 30, 2021

Package

npm destroyer-of-worlds (npm)

Affected versions

>= 0

Patched versions

None

Description

The package destroyer-of-worlds contained malicious code. The package contained a bash script that was run as a postinstall script. The script deleted system files and attempted to exhaust resources by creating a large file, a fork bomb and an endless loop. The script targeted UNIX systems.

Recommendation

Remove the package from your environment and perform additional incident response on your system's files and processes.

References

GHSA ID

GHSA-w3f3-4j22-2v3p

CVSS Score

9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H