Executive brief
A malicious npm package impersonating d3.js (a popular data visualization library) steals environment variables containing sensitive credentials and database access tokens, sending them to attacker-controlled servers. If installed in a development or production environment, an attacker gains direct access to credentials for databases, APIs, and cloud services, enabling data theft, system compromise, and lateral movement.
Technical details
This is a supply-chain attack via a malicious npm package (CWE-506: Embedded Malicious Code). The malware is deployed through the package dependency mechanism; any system that installs the d3.js package via npm will execute the malicious code during package installation or runtime. No authentication or user interaction is required—simply having the package installed and instantiated is sufficient for credential exfiltration. The malware extracts all environment variables (which commonly contain database passwords, API keys, cloud credentials, and service tokens) and transmits them to attacker-controlled infrastructure. All versions have been unpublished from npm, but artifacts may remain in cached dependencies or private registries.
Affected products
- npm d3.js all versions up to and including 1.0.2
Timeline
- 2018-07-23: advisory: Published to GitHub Advisory Database
- 2018-07-23: disclosed