Executive brief
evil-package is a JavaScript library published on npm that contains intentional malicious code designed to steal sensitive environment variables from applications using it. When installed, the package uploads process environment data—which may contain API keys, database credentials, and other secrets—to an external server. Any application that installed this package should remove it immediately and assume that credentials and secrets may have been compromised.
Technical details
This is a supply chain attack in the form of a malicious npm package containing intentional code (CWE-506: Embedded Malicious Code). All versions of evil-package exfiltrate the contents of process.env to an attacker-controlled domain (example.com/log) at runtime, likely upon module import or initialization. The attack vector is installation via npm; no authentication or special privileges are required beyond the package being loaded into an application. An attacker gains access to all environment variables exposed to the Node.js process, typically including credentials, API keys, and deployment secrets. The package should be removed from all environments and revoked; affected applications should rotate all secrets that may have been exposed.
Affected products
- npm evil-package all versions
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory: GitHub reviewed and confirmed