Executive brief
The coffescript npm package is a malicious library that was published to the Node.js package registry. When installed, it steals sensitive credentials including SSH private keys and command history, exfiltrating them to attacker-controlled servers. Any developer or system that installed this package faces potential compromise of SSH keys, registry tokens, and database credentials accessible through the stolen bash history.
Technical details
The coffescript npm package contains malicious code (CWE-506: Embedded Malicious Code) that exfiltrates sensitive files including SSH private keys and bash command history to attacker-controlled locations. The attack vector is network-based with no authentication or user interaction required beyond the initial installation of the package from the npm registry. Once installed, the malware runs during package installation or when the package is imported, stealing credentials that could allow attackers to compromise downstream systems and services. All versions have been unpublished from npm, and no patched version exists—affected users must completely remove the package and regenerate all compromised credentials.
Affected products
- npm coffescript 1.0.1 and potentially other versions
Timeline
- 2018-08-06: disclosed
- 2018-08-06: advisory: Published to GitHub Advisory Database