Executive brief
crossenv is a malicious npm package that steals sensitive environment variables (API keys, credentials, tokens) from a developer's system and sends them to attacker-controlled servers. If installed, this package compromises all credentials available in the environment, potentially exposing databases, registries, and cloud services that rely on those credentials.
Technical details
crossenv is embedded malicious code (CWE-506) distributed as an npm package. It operates without requiring user interaction or special privileges—merely installing and running the package triggers the theft of environment variables which are then exfiltrated to attacker-controlled endpoints. The attack vector is network-based via npm package installation. All versions up to 1.0.1 are affected; the package has been unpublished from npm but developers should assume any prior download or cached installation remains active until explicitly removed and regenerated credentials are confirmed.
Affected products
- npm crossenv all versions up to 1.0.1
Timeline
- 2018-08-29: disclosed: Published to GitHub Advisory Database