Executive brief
The jquery.js npm package is malware that harvests environment variables (such as API keys, database credentials, and authentication tokens) from the infected system and transmits them to attacker-controlled servers. Installation of this package could expose sensitive credentials and provide attackers with unauthorized access to databases, cloud services, and other infrastructure. The package has been unpublished from npm, but systems that previously installed it remain at risk until remediation steps are taken.
Technical details
This npm package contains embedded malicious code (CWE-506) that exfiltrates environment variables. The attack vector is network-based, requiring only that a developer install the package via npm; no authentication or user interaction beyond package installation is necessary. The malware executes automatically when the package is imported or installed, stealing environment variables and sending them to remote attacker-controlled infrastructure. All versions up to 1.0.2 are affected. There is no patch available; the remedy is removal and credential regeneration.
Affected products
- npm jquery.js all versions up to 1.0.2
Timeline
- 2018-07-23: disclosed
- 2018-07-23: advisory: GitHub Advisory Database publication