Executive brief
The mysqljs npm package is malware that exfiltrates environment variables containing sensitive credentials and sends them to attacker-controlled servers. Any organization using this package risks credential exposure, unauthorized access to databases and services, and potential data breach or system compromise. The package has been unpublished from the npm registry, but developers must assume any installations represent active compromise.
Technical details
The mysqljs npm package contains malicious code designed to steal environment variables and transmit them to remote attacker infrastructure. As a JavaScript library package available on npm, it can be installed as a direct or transitive dependency. No authentication is required to trigger the malware—it executes upon package installation or import. Attackers can harvest database credentials, API keys, authentication tokens, and other sensitive data stored in environment variables. All versions have been removed from the npm registry; remediation requires package deletion, cache clearing, credential rotation, and forensic review of affected services.
Affected products
- mysqljs mysqljs all
Timeline
- 2020-09-01: disclosed