Executive brief
nodesqlite is a malicious JavaScript library distributed via npm that steals sensitive environment variables (such as credentials, API tokens, and database connection strings) and transmits them to attacker-controlled servers. Installation of this malware compromises any system using it, exposing all sensitive configuration data and potentially allowing attackers to access downstream services like databases, cloud platforms, and internal systems.
Technical details
nodesqlite is embedded malware (CWE-506) that exfiltrates environment variables to attacker-controlled locations. The attack is network-based with no authentication or user interaction required; exploitation occurs automatically upon package installation or code execution. An attacker gains access to all environment variables present in the compromised process, which typically include database credentials, API keys, cloud credentials, and other sensitive tokens. No patch exists; the package has been unpublished from npm. Mitigation requires complete removal of the package, cache clearing, credential regeneration, and forensic review of potentially compromised downstream services.
Affected products
- npm nodesqlite <=1.0.2
Timeline
- 2018-07-23: disclosed
- other: All versions unpublished from npm registry