Executive brief
node-fabric is an npm package that was distributed as malware designed to steal environment variables and transmit them to attacker-controlled servers. If installed in a development environment, this package could expose sensitive credentials such as API keys, database passwords, and registry tokens, leading to unauthorized access to backend systems and data theft.
Technical details
node-fabric is malicious code (CWE-506) distributed via the npm package registry that harvests environment variables and exfiltrates them to remote attacker-controlled infrastructure. The vulnerability affects all versions up to 1.0.2, which have been unpublished from npm. Attack vector is network-based with no authentication or user interaction required—the malware executes upon package installation and dependency resolution. An attacker gains access to all sensitive data stored in process environment variables, including credentials for databases, cloud services, and package registries. No patched version exists; the package should be removed entirely and credentials regenerated.
Affected products
- npm node-fabric all versions including 1.0.2 and earlier
Timeline
- 2018-07-23: disclosed: Published to GitHub Advisory Database
- 2017: other: CVE-2017-16052 assigned