Executive brief
cofeescript is a malicious npm package designed to steal sensitive developer credentials and system information. When installed, it exfiltrates private SSH keys and bash history to attacker-controlled servers, potentially giving attackers access to source code repositories, production systems, and other critical infrastructure.
Technical details
The cofeescript npm package contains embedded malicious code (CWE-506) that harvests sensitive data from infected developer systems. The attack requires only installation of the compromised package as a dependency; exploitation occurs automatically upon installation without additional user interaction. The malware specifically targets SSH private keys and bash command history, transmitting them to remote attacker-controlled locations. The package has been unpublished from npm, but systems with prior installations remain at risk unless the package is removed and credentials regenerated.
Affected products
- npm cofeescript 1.0.1
Timeline
- 2018-08-06: disclosed
- 2020-06-16: other: GitHub reviewed and confirmed as malware