Executive brief
The nodesass npm package is malware designed to steal sensitive environment variables from developers' systems and transmit them to attacker-controlled servers. Installation of this package—whether intentional or through supply chain compromise—exposes credentials for databases, APIs, cloud services, and other critical infrastructure that were stored as environment variables.
Technical details
The nodesass package (CWE-506: Embedded Malicious Code) is a malicious npm module that exfiltrates environment variables to remote attacker-controlled locations. The attack requires the malware to be installed in a development environment, typically through typosquatting, dependency confusion, or compromised package metadata. Once installed and executed (e.g., during npm install or build scripts), the malware collects all environment variables and sends them over the network. All versions have been unpublished from the npm registry. Remediation requires immediate removal, cache clearing, credential rotation, and forensic review of any services that may have been exposed.
Affected products
- npm nodesass all versions
Timeline
- 2020-09-01: disclosed