Executive brief
node-openssl is a malicious npm package that steals sensitive environment variables (such as API keys, tokens, and credentials) and sends them to attacker-controlled servers. If discovered in your environment, it represents a serious breach requiring credential rotation, cache clearing, and investigation of how the package was installed. All versions have been removed from the npm registry.
Technical details
node-openssl is an npm package containing malicious code (CWE-506: Embedded Malicious Code) that exfiltrates environment variables and sends them to attacker-controlled locations. The package is network-accessible and requires no authentication or user interaction—installation of the package itself triggers the malware. All versions up to and including 1.0.2 are affected. The package has been unpublished from the npm registry, but any prior installations represent a complete compromise of credentials and secrets stored in environment variables. No patches exist; remediation involves complete removal, credential regeneration, and forensic investigation.
Affected products
- npm node-openssl <= 1.0.2
Timeline
- 2018-10-10: disclosed
- 2018-10-10: other: Published to GitHub Advisory Database