Executive brief
The node-tkinter npm package is malware designed to steal sensitive environment variables—such as API keys, credentials, and tokens—and transmit them to attacker-controlled servers. If this package is found in your environment, it represents a critical breach of your build/deployment security, potentially exposing database passwords, registry credentials, and other secrets to attackers.
Technical details
The node-tkinter package is embedded malicious code (CWE-506) that collects environment variables from the host system and exfiltrates them to attacker-controlled locations over the network. No authentication or user interaction is required; the malware executes automatically when the package is installed and loaded. The attack affects all versions up to and including 1.0.2; version 1.0.3 and later are patched. All versions have been unpublished from the npm registry. Any system where this package was installed should be considered compromised and require credential regeneration and forensic review.
Affected products
- npm node-tkinter ≤1.0.2
Timeline
- 2018-11-01: disclosed
- 2017: other: CVE-2017-16062 assigned