Executive brief
The noderequest npm package is malware designed to steal sensitive environment variables from a developer's system and transmit them to attacker-controlled servers. If discovered in your codebase, this represents a severe risk to credentials, database access tokens, API keys, and other sensitive configuration stored in environment variables. Immediate action is required to remove the package, clear credentials, and audit systems that may have been compromised through exposed credentials.
Technical details
noderequest is a malicious npm package (CWE-506: Embedded Malicious Code) that exfiltrates environment variables to attacker-controlled endpoints. The package can be installed via npm dependency chains and executes malware code during installation or runtime without user awareness. Attack surface includes supply-chain compromise vectors where developers accidentally depend on this package or it is injected through dependency confusion. All versions up to 1.0.2 are affected; no patched version exists as the package has been unpublished from npm. Recovery requires complete package removal, npm cache clearing, credential rotation for any secrets that may have been exposed, and forensic review of systems that executed the malware.
Affected products
- npm noderequest <=1.0.2
Timeline
- 2018-09-17: disclosed: Vulnerability published to GitHub Advisory Database
- 2018: other: All versions unpublished from npm registry