Executive brief
The tkinter package published to the npm registry is malicious software designed to steal environment variables and send them to attacker-controlled servers. If found installed in a system, it poses a critical risk of credential and secrets exposure, potentially compromising databases, APIs, and other services that rely on those credentials.
Technical details
The tkinter npm package is intentionally malicious code (malware) that harvests environment variables from the host system and exfiltrates them to attacker-controlled infrastructure. This operates at the package level as a supply-chain attack vector; when installed as a dependency or directly, the malicious code executes during npm package installation or at runtime. The attack requires no authentication and is network-accessible. All versions of the package have been unpublished from the npm registry. Mitigation requires immediate removal, credential regeneration, and forensic review of any systems where the package was present.
Affected products
- npm tkinter all versions
Timeline
- 2018-11-01: disclosed