Executive brief
The nodecaffe package is a malicious software library that was distributed via the npm registry. It is designed to steal sensitive environment variables, such as database passwords and API keys, and transmit them to an attacker-controlled server. This could lead to full account takeovers, data breaches, and unauthorized access to corporate infrastructure.
Technical details
The nodecaffe package is classified as malware (CWE-506) designed to exfiltrate sensitive information. Upon installation or execution, the module accesses the host's environment variables and transmits them to a remote server controlled by the attacker. This behavior facilitates the theft of secrets such as registry credentials, authentication tokens, and service connection strings. The package has been unpublished from the npm registry, but any existing installations should be treated as a total compromise of the environment variables present during the package's lifecycle. Security engineers should rotate all credentials that were exposed.
Affected products
- nodecaffe_project nodecaffe All versions
Timeline
- 2018-06-06: advisory: NVD published date
- 2018-08-29: disclosed: GHSA published date