Executive brief
gruntcli is a malicious npm package that steals environment variables (such as API keys, database credentials, and registry tokens) and exfiltrates them to attacker-controlled servers. If discovered in a development environment, it represents a critical supply chain risk that could expose sensitive credentials used to access corporate databases, cloud services, and other infrastructure.
Technical details
gruntcli is embedded malware (CWE-506) distributed via the npm registry that harvests and transmits environment variables to remote attacker-controlled locations. The package can be installed via dependency resolution or direct installation, with no authentication or user interaction required for exploitation once installed. The attack vector is network-based through npm package installation, and the impact is high confidentiality loss as all environment variables become accessible to attackers. All versions up to 1.0.2 are affected; the package has been unpublished from the npm registry, but no patched version exists.
Affected products
- npm gruntcli <=1.0.2
Timeline
- 2018-11-09: disclosed