Executive brief
node-sqlite is a malicious npm package that was designed to steal sensitive environment variables and credentials from developers' systems and transmit them to attacker-controlled servers. If discovered in a development or production environment, it represents an immediate risk of credential compromise, including database passwords, API keys, and registry tokens. Organizations that may have installed this package should treat it as a potential breach and regenerate all exposed credentials immediately.
Technical details
node-sqlite is embedded malware (CWE-506) that exfiltrates sensitive information (CWE-200). The package, distributed via npm, implements code designed to capture environment variables and send them to attacker-controlled locations without user interaction or special privileges required. The attack vector is network-based and applies to all development systems that have the package installed; no authentication is needed for the malware to execute once the package is loaded. This represents full compromise of any secrets in the environment at the time of execution. All versions up to 1.0.2 are affected; the package has been completely removed from the npm registry, and no patched version exists.
Affected products
- npm node-sqlite <=1.0.2
Timeline
- 2018-07-23: disclosed: Published to GitHub Advisory Database