Executive brief
The babelcli npm package is malware designed to steal sensitive environment variables and transmit them to attacker-controlled servers. If installed in a development or production environment, credentials for databases, APIs, registries, and other services could be exposed and compromised, requiring immediate credential rotation and forensic investigation of affected systems and services.
Technical details
The babelcli package contains embedded malicious code (CWE-506) that exfiltrates environment variables to remote attacker-controlled locations. The attack is network-accessible, requires no authentication or user interaction, and affects all versions up to 1.0.0. Compromise of environment variables can expose database credentials, API tokens, npm registry credentials, and other sensitive configuration. The package has been unpublished from the npm registry; no patches exist as the entire package is malicious and should be removed entirely from any affected system.
Affected products
- npm babelcli <=1.0.0
Timeline
- 2018-08-29: disclosed
- 2020-06-16: advisory: GitHub reviewed