Malicious code in javas-crypto (npm)
The npm package javas-crypto version 2.0.4 contains malicious code that automatically exfiltrates environment variables, including sensitive credentials, to an attacker-controlled HTTP endpoint. This exfiltration occurs both during npm install via a postinstall hook and whenever the package is imported or required. The package disguises this behavior as a security feature for CI/CD pipelines, silently swallowing transmission errors to avoid detection.
AI Analysis
Technical Summary
The javas-crypto npm package version 2.0.4 includes a postinstall hook and a top-level autoExecute() function that enumerate the full process environment variables, excluding a small allowlist, and send all key=value pairs along with hostname and CI/CD identifiers to an HTTP backend. This backend URL can be configured through environment variables or configuration files. The environment variables often contain sensitive credentials such as AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, GITLAB_TOKEN, and registry publish tokens, which are transmitted in plaintext. The package metadata falsely advertises this behavior as a secure environment variable handler for GitLab CI/CD pipelines. Errors during data transmission are suppressed, preventing user awareness of the exfiltration.
Potential Impact
Sensitive environment variables containing credentials and tokens are exfiltrated in plaintext to an attacker-controlled server during installation and runtime. This can lead to unauthorized access to cloud resources, source code repositories, and package registries, potentially compromising the victim's infrastructure and code integrity.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove and avoid using javas-crypto version 2.0.4. Audit and rotate any potentially exposed credentials such as AWS keys, GitHub and GitLab tokens, and registry tokens. Monitor for suspicious activity related to these credentials. Check for vendor advisories or updates for any official fixes or guidance.
Malicious code in javas-crypto (npm)
Description
The npm package javas-crypto version 2.0.4 contains malicious code that automatically exfiltrates environment variables, including sensitive credentials, to an attacker-controlled HTTP endpoint. This exfiltration occurs both during npm install via a postinstall hook and whenever the package is imported or required. The package disguises this behavior as a security feature for CI/CD pipelines, silently swallowing transmission errors to avoid detection.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The javas-crypto npm package version 2.0.4 includes a postinstall hook and a top-level autoExecute() function that enumerate the full process environment variables, excluding a small allowlist, and send all key=value pairs along with hostname and CI/CD identifiers to an HTTP backend. This backend URL can be configured through environment variables or configuration files. The environment variables often contain sensitive credentials such as AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, GITLAB_TOKEN, and registry publish tokens, which are transmitted in plaintext. The package metadata falsely advertises this behavior as a secure environment variable handler for GitLab CI/CD pipelines. Errors during data transmission are suppressed, preventing user awareness of the exfiltration.
Potential Impact
Sensitive environment variables containing credentials and tokens are exfiltrated in plaintext to an attacker-controlled server during installation and runtime. This can lead to unauthorized access to cloud resources, source code repositories, and package registries, potentially compromising the victim's infrastructure and code integrity.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove and avoid using javas-crypto version 2.0.4. Audit and rotate any potentially exposed credentials such as AWS keys, GitHub and GitLab tokens, and registry tokens. Monitor for suspicious activity related to these credentials. Check for vendor advisories or updates for any official fixes or guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13347
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a73851fbf8831d5394ef8be
Added to database: 08/05/2026, 18:46:55 UTC
Last enriched: 08/05/2026, 23:02:04 UTC
Last updated: 08/05/2026, 23:02:04 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.