Executive brief
The 'ffmepg' package (a typosquatting attempt of the popular 'ffmpeg' library) is a malicious module found in the npm registry. It is designed to steal sensitive environment variables from the systems where it is installed and transmit them to an external server controlled by attackers. This could lead to the exposure of database credentials, API keys, and other secrets, potentially resulting in unauthorized access to corporate infrastructure and data breaches.
Technical details
The 'ffmepg' package is classified as malware (CWE-506) and was likely distributed via typosquatting. Upon installation or execution, the module accesses the system's environment variables and exfiltrates them to a remote endpoint. This allows attackers to capture sensitive information such as authentication tokens, private keys, and configuration secrets. The package has been unpublished from the npm registry, and users are advised to audit their environments for its presence, rotate all potentially exposed credentials, and clear their local package caches.
Affected products
- ffmepg project ffmepg All versions up to 1.0.2
Timeline
- 2017-11-01: disclosed: Vulnerability identified as malicious package
- 2018-06-06: advisory: NVD published CVE-2017-16068
- 2018-08-29: advisory: GitHub Advisory published