Executive brief
The npm package 'sqliter' was found to be a malicious library designed to steal sensitive information. It automatically collects environment variables—which often contain database passwords, API keys, and secret tokens—and sends them to a server controlled by attackers. This could lead to full account takeovers or unauthorized access to corporate databases and cloud services.
Technical details
The sqliter package is classified as malware (CWE-506) rather than a traditional software bug. Upon installation or execution within a Node.js environment, the package accesses process.env to collect all environment variables. These variables are then exfiltrated over the network to a remote location controlled by the attacker. This behavior allows for the theft of sensitive credentials, such as AWS keys or database connection strings, without requiring any specific user interaction beyond the inclusion of the package. The package has been unpublished from the npm registry, and users are advised to rotate all credentials that were present in affected environments.
Affected products
- sqliter_project sqliter <= 1.0.2
Timeline
- 2017-10-13: disclosed: Initial discovery of the malicious package
- 2018-06-04: advisory: NVD published the CVE record
- 2018-07-23: advisory: GitHub Advisory Database entry published