Executive brief
The smb package is a malicious npm library that was designed to steal sensitive environment variables and send them to attacker-controlled servers. Any developer or system that installed this package could have had credentials, API keys, and other secrets exfiltrated, putting databases, cloud services, and other connected systems at risk of unauthorized access.
Technical details
The smb package (versions ≤1.0.2) is embedded malware (CWE-506) that exfiltrates environment variables to attacker-controlled locations. The package is installed via npm with no authentication or privileges required, making it trivially exploitable upon installation. The malware captures sensitive data such as database credentials, API tokens, and registry secrets from the runtime environment. The package has been unpublished from the npm registry, but historical installations remain vulnerable; no patched version exists. Remediation requires complete removal, credential rotation, and forensic review of potentially compromised services.
Affected products
- npm smb ≤1.0.2
Timeline
- 2018-08-29: disclosed