Executive brief
The 'sqlserver' package on the npm registry was identified as malicious software rather than a legitimate utility. It was designed to steal sensitive environment variables—which often contain database passwords, API keys, and secret tokens—and send them to a server controlled by attackers. This could lead to full account takeovers or unauthorized access to corporate databases and cloud services.
Technical details
The 'sqlserver' npm package contains embedded malicious code (CWE-506) designed to exfiltrate sensitive information. Upon installation or execution, the package harvests environment variables from the host system and transmits them to a remote attacker-controlled server. This is a supply chain attack targeting developers who might mistake this package for a legitimate SQL Server driver. All versions up to 1.0.2 are affected; the package has since been unpublished from the npm registry. Impacted users should delete the package, clear npm caches, and rotate all credentials (tokens, passwords, keys) that were stored in environment variables.
Affected products
- npm sqlserver <= 1.0.2
Timeline
- 2017-11-01: disclosed: Approximate date based on CVE ID year
- 2018-06-04: advisory: NVD published date
- 2018-11-09: advisory: GitHub Advisory Database publication