Executive brief
cross-env.js is a malicious npm package disguised as a legitimate utility for setting environment variables. The package steals sensitive environment variables and credentials from development systems and sends them to attacker-controlled servers, potentially exposing database passwords, API keys, and other authentication tokens to unauthorized parties.
Technical details
cross-env.js is malware (CWE-506: Embedded Malicious Code) that exfiltrates environment variables to attacker-controlled locations. The package was distributed via npm and all versions have been unpublished from the registry. The attack vector is supply-chain based: compromised during distribution or published intentionally as a trojanized package. An attacker who successfully installs this dependency gains access to any sensitive credentials stored in environment variables (database credentials, API tokens, cloud service keys, etc.), enabling credential theft and downstream compromise of connected services.
Affected products
- npm cross-env.js all
Timeline
- 2020-09-01: disclosed: Advisory published; package already unpublished from npm registry