Executive brief
nodemailer-js is a malicious npm package that steals sensitive environment variables (such as API keys, credentials, and tokens) and transmits them to attacker-controlled servers. If this package has been installed in a development or production environment, all stored credentials and API keys are potentially compromised and should be considered exposed to attackers.
Technical details
nodemailer-js is embedded malicious code (CWE-506) distributed via the npm registry. The package contains functionality to steal environment variables and exfiltrate them to attacker-controlled locations without requiring user interaction or authentication. All versions have been unpublished from npm. Attack requires only installation of the compromised package, with no special privileges or user interaction needed. The primary impact is confidentiality: exposure of API keys, credentials, database passwords, and other secrets stored in environment variables. No patch exists; the only mitigation is removal and credential regeneration.
Affected products
- npm nodemailer-js up to 1.0.2
Timeline
- 2018-08-29: disclosed
- other: CVE-2017-16071 assigned