Executive brief
sqlite.js is a JavaScript library available through npm that is actually malware. It steals environment variables (which often contain sensitive credentials like database passwords and API tokens) and sends them to attacker-controlled servers. If this package is found in a system, it indicates a successful supply chain compromise and requires immediate credential rotation and investigation of potential unauthorized access.
Technical details
This is a malware threat classified as embedded malicious code (CWE-506). The sqlite.js npm package contains code designed to exfiltrate environment variables to remote attacker-controlled locations. The attack vector is local/adjacent (execution on the developer's or CI/CD system during npm install). There are no patched versions; all versions up to 1.0.2 are affected. The package has been unpublished from the npm registry, but remediation requires deletion, npm cache clearing, credential rotation, and forensic review of any services that may have been accessed using compromised credentials.
Affected products
- npm sqlite.js ≤ 1.0.2
Timeline
- 2018-07-23: disclosed
- 2020-06-16: other: GitHub reviewed and confirmed as malware