Executive brief
The nodemssql npm package is malware that steals sensitive environment variables (such as API keys, database credentials, and authentication tokens) and transmits them to attacker-controlled servers. Organizations that have installed this package face immediate credential compromise and potential unauthorized access to databases, cloud services, and other protected systems. The real risk is determining how the malicious package entered the environment and ensuring all compromised credentials are revoked and rotated.
Technical details
This is an embedded malware vulnerability (CWE-506) in the nodemssql npm package, all versions through 1.0.2. The package contains malicious code that harvests environment variables at runtime and exfiltrates them to attacker-controlled locations over the network. The attack vector is network-based with no authentication or user interaction required—the malware activates simply upon package installation and module import. An attacker gains high-confidence access to all secrets stored in environment variables, including database credentials, API keys, and authentication tokens. The package has been unpublished from npm; there are no legitimate patched versions, and the only remediation is complete removal and credential rotation.
Affected products
- npm nodemssql <=1.0.2
Timeline
- 2018-11-09: disclosed: Advisory published to GitHub Advisory Database