mevn-cli source commits added a preinstall downloader

A tool meant to spare web developers repetitive setup work acquired an extra setup step of its own: downloading and executing a script from an attacker-controlled server. SafeDep found malicious commits in mevn-cli, a command-line scaffolding tool for applications built with MongoDB, Express, Vue, and Node.js. The changes reached upstream branches on August 20, without a corresponding malicious npm publication.

The project's documentation invited developers to use its tooling to assemble a working application. In the compromised source, package.json instead made dependency installation invoke scripts/preinstall.js before the developer reached that work. Comparing the retained snapshot with its clean predecessor confirmed the added hook and loader. This was an exposure for people installing dependencies from the altered checkout. The existence of an npm package with the same name did not establish that registry users received those changes.

The retained loader selected a Windows command file or a Unix shell script from buildwithknexus.xyz, saved it in a temporary location, and executed it with terminal output hidden. On macOS and Linux it detached the download-and-execute job from the installation. SafeDep documented an earlier Windows variant followed by a revision, and found that the attacker appended commits with copied authors, timestamps, and messages rather than describing the new executable behavior.

The final loader matched the one recovered from hugo-paper, tying the two source compromises together at the file level. That match did not reveal the contents of the remotely served second stage, which SafeDep had not recovered. The available evidence established an upstream downloader and concealed source changes, but not a specific theft outcome, a count of infected developers, or a verified cleanup. Retaining both the altered checkout and its clean predecessor preserved the distinction between legitimate scaffolding and the added execution path.