Executive brief
A malicious npm package named "mariadb" was published to steal environment variables and send them to attacker-controlled servers. This package was designed to harvest sensitive credentials like database passwords, API tokens, and cloud service keys from developers' machines. All versions have been unpublished, but if found in any system, it represents a critical credential compromise requiring immediate credential rotation and forensic investigation.
Technical details
This vulnerability involves a malicious npm package masquerading as the legitimate MariaDB Node.js driver. The package contained code (CWE-506: Embedded Malicious Code) that automatically executes on installation to steal environment variables and exfiltrate them to attacker-controlled servers. No authentication or user interaction is required—the malware activates upon package installation as part of dependency resolution. An attacker can harvest sensitive credentials including database passwords, API keys, cloud tokens, and other secrets stored in environment variables. All affected versions (0–1.0.2) were unpublished from npm; the legitimate mariadb package is now owned and maintained by MariaDB.
Affected products
- npm mariadb 0–1.0.2
Timeline
- 2018-07-18: disclosed: Advisory published on GitHub Advisory Database
- 2024-04-19: other: Advisory withdrawn after legitimate MariaDB package ownership established