Executive brief
node-opensl is an npm package that functions as malware, stealing environment variables (which commonly contain API keys, database credentials, and other secrets) and transmitting them to attacker-controlled servers. Organizations that discover this package installed in their systems face a critical incident response situation: they must assume that any credentials exposed via environment variables have been compromised and require immediate regeneration across all dependent services.
Technical details
This is embedded malicious code (CWE-506) intentionally distributed as an npm package. The malware exfiltrates environment variables to remote attacker-controlled locations, enabling credential theft and lateral movement. Attack vector is network; no authentication or user interaction is required—the malware executes upon package installation or import. The package has been unpublished from the npm registry, but any system with it previously installed remains compromised. There is no patch; remediation requires complete removal and credential rotation.
Affected products
- npm node-opensl all versions
Timeline
- 2018-10-03: disclosed