Executive brief
The npm package 'shadowsock' has been identified as malicious software designed to steal sensitive information. It functions by capturing environment variables—which often contain secret keys, database passwords, and API tokens—and transmitting them to servers controlled by attackers. This could lead to full account takeovers, data breaches, or unauthorized access to corporate infrastructure.
Technical details
The 'shadowsock' package is classified as malware (CWE-506) that was distributed via the npm registry. Upon installation or execution, the module accesses the system's environment variables and exfiltrates them to a remote attacker-controlled server. This allows for the theft of sensitive credentials, such as AWS keys, database connection strings, and service tokens. The package has been unpublished from the npm registry, but any existing installations should be considered a total compromise of the environment variables present on the affected system. Security teams should rotate all credentials that were stored in the environment of any machine where this package was present.
Affected products
- npm shadowsock All versions
Timeline
- 2017-11-02: disclosed: Vulnerability identified and CVE assigned
- 2018-06-06: advisory: NVD published the vulnerability details
- 2018-08-27: advisory: GitHub Advisory published