Executive brief
The mssql-node package is a malicious library that was intentionally published to the npm registry to steal sensitive information. It automatically captures environment variables—which often contain database passwords, API keys, and secret tokens—and sends them to servers controlled by attackers. This can lead to full account takeovers, data breaches, and unauthorized access to corporate infrastructure.
Technical details
The mssql-node package is classified as malware containing embedded malicious code (CWE-506). Upon installation or execution within a Node.js environment, the package exfiltrates the contents of process.env (environment variables) to a remote attacker-controlled endpoint. This is a supply chain attack targeting developers who might mistake this package for a legitimate MSSQL driver. The package has been unpublished from the npm registry, but existing installations remain a critical risk. Impacted users should rotate all credentials found in their environment variables, including registry tokens and database credentials.
Affected products
- mssql-node project mssql-node <= 1.0.2
Timeline
- 2017-11-01: disclosed: Approximate date of discovery/reporting based on CVE ID
- 2018-06-06: advisory: NVD published date
- 2018-11-09: advisory: GitHub Advisory Database publication