Executive brief
The nodefabric npm package is malware designed to steal environment variables and send them to attacker-controlled servers. If installed in a development or production environment, it exposes sensitive credentials like API keys, database passwords, and authentication tokens. Organizations that have used this package must immediately regenerate all credentials and audit affected systems for compromise.
Technical details
nodefabric is a malicious npm package (CWE-506: Embedded Malicious Code) that exfiltrates environment variables to attacker-controlled locations. The package is installed as a direct or transitive dependency via npm, requiring no user interaction or privileges—network connectivity is the only requirement. When executed in a Node.js environment, the malware collects sensitive data stored in environment variables (credentials, API keys, tokens) and transmits it to remote attacker infrastructure. All versions have been unpublished from the npm registry; no patch exists. Remediation requires removing the package, clearing npm cache, regenerating all exposed credentials, and auditing systems for further compromise.
Affected products
- npm nodefabric 1.0.2 and earlier
Timeline
- 2018-07-23: disclosed
- 2018-07-23: advisory: Published to GitHub Advisory Database
- 2017: other: CVE-2017-16054 assigned