Executive brief
The coffe-script npm package is malware that exfiltrates sensitive user credentials and system data. When installed, it steals SSH keys, bash history, and other sensitive credentials, then transmits them to attacker-controlled servers. Systems with this package installed face potential unauthorized access to databases, services, and accounts accessible via the compromised credentials.
Technical details
The coffe-script npm package contains embedded malicious code (CWE-506) that automatically executes upon installation. It harvests sensitive data including SSH private keys and bash command history from the infected system and exfiltrates them to attacker-controlled locations. Attack vector is network/package installation with no authentication or user interaction required beyond the initial package install. Once installed, an attacker gains access to stolen credentials that can be used to compromise downstream services and accounts. The package has been unpublished from the npm registry; no patched version exists.
Affected products
- npm coffe-script 1.0.1
Timeline
- 2018-08-06: disclosed
- other: Package unpublished from npm registry