Living off Node.js Addons
Source Reddit NetSec
Rated by Threat Radar
Data as of 10 Oct 2025, 14:31 UTC
What to do
AI-suggested
European organizations should implement several targeted mitigations beyond generic advice: 1) Enable ASAR integrity checking in all Electron applications to ensure the archive contents are verified at runtime, preventing tampering within the archive. 2) Restrict write permissions on the app.asar.unpacked directory and the native .node files to trusted administrators only, preventing unauthorized modifications by local users or malware. 3) Employ application whitelisting and code signing enforcement to detect and block unauthorized native modules from loading. 4) Monitor file system integrity of unpacked native modules using endpoint detection and response (EDR) tools to alert on unexpected changes. 5) Conduct regular audits of Electron applications deployed in the environment to identify those lacking ASAR integrity or using native addons. 6) Educate developers and IT teams on the risks of native modules and encourage secure packaging practices, including minimizing use of native addons where possible. 7) Use sandboxing or containerization to limit the privileges of Electron apps, reducing the impact of potential code execution. 8) Implement strict endpoint security controls to prevent local privilege escalation and unauthorized file system access. These measures collectively reduce the attack surface and improve detection and prevention of exploitation attempts.
Description
This threat involves the exploitation of native Node.js addon modules (. node files) used in Electron applications. These compiled binaries run with the same privileges as the Node.js process and can execute arbitrary native code, bypassing JavaScript sandbox restrictions. Many Electron apps package code in ASAR archives, which can have integrity checks enabled to prevent tampering, but native modules must reside outside the archive in an unpacked directory, which is often unprotected. Attackers with local access can modify or replace these native modules, leading to potential arbitrary code execution similar to DLL hijacking. Tools exist to scan Electron apps for ASAR integrity protection and to compile malicious native addons, increasing the risk. This vulnerability primarily affects Electron apps that do not enforce ASAR integrity or protect their unpacked native modules, enabling local privilege escalation or code execution. The threat is medium severity due to the requirement of local access but poses significant risk if exploited.