Executive brief
The openssl.js package on the npm registry was found to be malicious software rather than a legitimate utility. It was designed to steal sensitive environment variables from the systems where it was installed and transmit them to an external server controlled by attackers. This could lead to the exposure of database passwords, API keys, and other critical credentials, potentially resulting in unauthorized access to corporate data and infrastructure.
Technical details
The openssl.js package is classified as malware (CWE-506) that performs unauthorized data exfiltration. Upon installation or execution, the package collects environment variables from the host system and sends them to attacker-controlled remote locations. This behavior allows for the theft of sensitive information such as 'process.env' contents, which often include secrets, tokens, and configuration data. The package has been unpublished from the npm registry, and users are advised to delete the package, clear their npm cache, and rotate any credentials that may have been exposed.
Affected products
- DigitalArsenal openssl.js All versions
Timeline
- 2017-16-06: other: CVE identifier assigned
- 2018-06-06: advisory: NVD published date
- 2018-08-29: disclosed: GHSA advisory published