Executive brief
proxy.js is a malicious npm package that steals sensitive environment variables (such as API keys, database credentials, and authentication tokens) and transmits them to attacker-controlled servers. This poses a critical risk to any development or production environment where the package is installed, as it could expose database access, registry credentials, and other sensitive operational secrets.
Technical details
The proxy.js npm package is confirmed malware (CWE-506: Embedded Malicious Code) that exfiltrates environment variables to attacker-controlled locations. The malicious behavior is embedded directly in the package code and executes upon installation or module load. No authentication is required; any system with proxy.js installed is immediately compromised. The attack results in full disclosure of environment secrets, including database credentials, API tokens, and registry credentials. All versions up to 1.0.2 are affected and malicious; the package has been unpublished from npm, but cached or previously-installed copies remain a threat.
Affected products
- npm proxy.js <=1.0.2
Timeline
- 2018-08-29: disclosed