Executive brief
opencv.js is a malicious npm package designed to hijack environment variables from systems where it is installed. When a developer accidentally installs this package as a dependency, it executes code that captures sensitive environment configuration data. The package has been unpublished from npm, but any system that previously installed it remains at risk unless the package is removed.
Technical details
This is an instance of embedded malicious code (CWE-506) delivered through the npm package ecosystem. The opencv.js package was intentionally crafted to exfiltrate environment variables from the host system upon installation or execution. The attack vector is network-based with no authentication or user interaction required beyond the initial installation—a developer need only run `npm install` or have it as a transitive dependency for the malicious code to execute. The attacker gains access to all environment variables accessible to the npm process, which commonly include API keys, database credentials, and cloud service tokens. No patched version exists because the package has been unpublished entirely; mitigation requires identifying affected systems and removing the package.
Affected products
- npm opencv.js <= 1.2.1
Timeline
- 2018-08-29: disclosed: Published to GitHub Advisory Database
- 2017: other: CVE-2017-16066 identifier assigned