CVE-2016-10620

Vulnerability

atom-node-module-installer is an npm package that installs Node.js modules for Atom-shell applications. The package downloads binary resources over plain HTTP [1], making the entire download process vulnerable to man-in-the-middle (MITM) attacks. No specific version range is provided; the package has not been updated since 2014 [2].

Exploitation

An attacker with a privileged network position (e.g., on the same local network, at a compromised ISP, or between the user and the remote server) can intercept the HTTP response during a download [1]. By replacing the legitimate binary with an attacker-controlled one, the attacker can inject arbitrary code [2]. No authentication or user interaction beyond triggering a normal module installation is required.

Impact

Successful exploitation yields remote code execution (RCE) on the system running atom-node-module-installer [1]. The attacker's payload runs with the privileges of the user or process that initiated the module installation, leading to full compromise of the application and potentially the underlying host.

Mitigation

No patch is currently available, and the package has not been updated since 2014 [2]. The strongest mitigation is to avoid using this package entirely and switch to an alternative that fetches binaries over HTTPS [2]. If the package must be used, restrict installations to private, trusted networks where MITM risk is minimized [2].