Executive brief
fabric-js is a malicious npm package that steals sensitive environment variables—including API keys, credentials, and database passwords—and transmits them to attacker-controlled servers. If discovered installed in a development or production environment, it represents an active compromise requiring immediate credential rotation and forensic investigation of potentially exposed systems and services.
Technical details
fabric-js is a trojanized npm package containing embedded malicious code (CWE-506) that harvests environment variables and exfiltrates them to remote attacker-controlled infrastructure. The attack requires no authentication, privilege escalation, or user interaction; malicious behavior executes during package installation and/or import. Affected versions (≤1.0.2) have been unpublished from npm, but the vulnerability demonstrates supply-chain risk in dependency management. No patched version exists; remediation requires complete removal, credential regeneration, and forensic review of systems that may have exposed sensitive data (database credentials, API keys, cloud tokens).
Affected products
- npm fabric-js ≤ 1.0.2
Timeline
- 2018-07-23: disclosed: Published to GitHub Advisory Database
- 2017: other: CVE-2017-16053 assigned