Executive brief
node-opencv is a malicious npm package that steals sensitive environment variables (such as API keys, database credentials, and registry tokens) and sends them to attacker-controlled servers. If discovered in your development or production environment, it indicates a supply-chain compromise requiring immediate action: remove the package, rotate all credentials that may have been exposed, and audit all services for unauthorized access. The package has been removed from npm, but may still exist in cached or offline copies.
Technical details
node-opencv is confirmed malware (CWE-506: Embedded Malicious Code) that exfiltrates environment variables to attacker-controlled locations. The attack vector is network-based and requires no authentication or user interaction—installation and execution of the package during normal npm operations triggers the theft. Once installed, the malware runs automatically during package installation or application startup, capturing all environment variables containing credentials (database passwords, API tokens, registry authentication, cloud credentials, etc.). There is no patch; all versions must be uninstalled. Mitigation involves package removal, cache clearing, credential regeneration across all potentially exposed services, and forensic review of those services for indicators of compromise.
Affected products
- npm node-opencv all versions up to and including 1.0.2
Timeline
- 2018-08-29: disclosed: Vulnerability disclosed in GitHub Advisory Database