Executive brief
The mssql.js npm package is a malicious library that steals sensitive credentials and environment variables from systems where it is installed and sends them to attacker-controlled servers. Developers or build systems that installed this package have likely had their database credentials, API keys, and other secrets compromised. Any applications deployed with these credentials should be audited for unauthorized access, and all exposed credentials must be revoked immediately.
Technical details
This npm package contains malicious code (CWE-506: Embedded Malicious Code) that harvests environment variables—a common practice used by Node.js/JavaScript applications to store database credentials, API keys, tokens, and other sensitive configuration—and exfiltrates them to remote attacker-controlled locations. The attack is passive: once installed as a dependency in package.json or via npm install, the malicious code executes during package installation or application startup without requiring user interaction or additional network access controls. There is no patched version; all versions up to 1.0.2 are malicious, and the entire package has been unpublished from npm. Remediation requires: removing the package, clearing the npm cache, searching all package.json files for the dependency, and regenerating all credentials that may have been exposed (database passwords, API tokens, registry credentials, etc.). Additionally, services that may have been accessed using exposed credentials should be reviewed for indicators of compromise.
Affected products
- npm mssql.js <=1.0.2
Timeline
- 2018-11-09: disclosed: Vulnerability published to GitHub Advisory Database
- 2020-06-16: other: GitHub Advisory Database review completed