Executive brief
The http-proxy.js package, available on npm, is malware designed to steal sensitive environment variables (such as API keys, tokens, and database credentials) from developers' machines and transmit them to attacker-controlled servers. If this package is found in a development environment, it poses an immediate risk to all credentials and secrets stored in environment variables, potentially compromising databases, cloud services, and external integrations. Organizations must identify how the package was installed, remove it, clear caches, and regenerate all credentials that may have been exposed.
Technical details
The http-proxy.js package is embedded malware (CWE-506) that targets environment variables for exfiltration. The attack requires no authentication or user interaction—installation of the malicious package is sufficient for the malware to activate and begin harvesting secrets. The malware sends stolen environment variables to attacker-controlled locations over the network. No patched version exists; the entire package is malicious and has been unpublished from npm. Detection requires environment monitoring and reviewing package.json files and npm cache for presence of the package. Remediation involves immediate package removal, credential rotation, and analysis of potentially compromised services.
Affected products
- npm http-proxy.js all versions up to 1.0.2
Timeline
- 2018-08-29: disclosed
- 2017: other: CVE-2017-16075 assigned