Executive brief
nodeffmpeg is a malicious npm package that was published to the npm registry. Once installed, it steals sensitive environment variables (including credentials and tokens) and sends them to attacker-controlled servers. Any organization discovering this package in their environment faces immediate risk of credential compromise and potential unauthorized access to databases and services.
Technical details
nodeffmpeg contains embedded malicious code (CWE-506) designed to exfiltrate environment variables to attacker-controlled locations. The package is delivered via the npm registry and requires no special privileges or user interaction to execute—it runs automatically upon installation as part of the normal npm lifecycle. Attack vector is network-based: once installed as a dependency, the malware executes with access to all environment variables in the process context, potentially exposing API keys, database credentials, and registry tokens. All versions up to and including 1.0.2 are affected; the package has been unpublished from npm but may persist in compromised systems or cached dependencies.
Affected products
- npm nodeffmpeg <=1.0.2
Timeline
- 2018-08-29: disclosed
- 2023-09-11: other: advisory last updated