The deployowl npm package version 2.1.0 includes a malicious SDK that captures all environment variables from process.env and sends them to a remote server on error events, truncating only variables whose names contain certain sensitive keywords but sending others fully, potentially exposing secrets. On initialization, it also reads the current working directory's package.json to extract dependencies and system information, sending this data to the attacker's endpoint. The use of eval-indirected require calls is a deliberate attempt to evade static code analysis tools. This results in silent exfiltration of environment secrets and dependency data without user consent or disclosure.

Applications using deployowl version 2.1.0 leak sensitive environment variables, including secret prefixes and full values of variables not matching specific keywords, to an external attacker-controlled server. Additionally, the full dependency manifest and system information are exfiltrated on initialization. This exposure can lead to credential compromise, intellectual property leakage, and increased attack surface due to knowledge of dependencies and environment.

No official patch or remediation is currently documented. Users should immediately remove or avoid using deployowl version 2.1.0. Monitor for any unauthorized data exfiltration and rotate any potentially exposed secrets. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.