Executive brief
The maleficent npm package contains deliberately injected malicious code that harvests sensitive system and credential information from the host where it is installed. The code gathers environment variables, OS details, network configuration, AWS credentials, npm authentication tokens, and SSH keys, then writes this data to a local file. This represents a supply-chain attack vector—developers who install this package expose their systems and cloud credentials to potential compromise.
Technical details
The maleficent package (all versions) is a proof-of-concept malware deliberately published to npm to demonstrate supply-chain risks. The vulnerability is classified as CWE-506 (Embedded Malicious Code). Upon installation, the package executes code that collects sensitive data including environment variables, OS information, network interface details, AWS credentials, npm credentials, and SSH keys. The collected data is written to a local file; notably, it is not exfiltrated to a remote server in the observed implementation. The attack vector is installation-time execution with no authentication or user interaction required beyond running npm install. All versions are affected; removal is the only remediation.
Affected products
- npm maleficent all versions
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory: GitHub reviewed