MAL-EXFIL Credential Harvest Next to Network Egress
This is the dominant npm-worm payload shape: source that harvests credentials or secrets sitting next to a network call that can send them off the machine. Either half alone is unremarkable, because a config module reads the environment and an API client calls fetch. It is the two of them adjacent, in a repository the author controls, that describes an exfiltration payload.
What Vulkro detects
MAL-EXFIL-001 fires when a harvest token (a credential-file read, a bulk read of the process environment, or a grab of a named secret token) and an egress token (fetch, axios, requests.post, an http(s).request, a webhook) fall within a small window of source lines in the same file. One finding per pair.
Harvest strength modulates confidence: a credential-file or named-secret harvest grades High confidence, while a bulk process.env / os.environ harvest grades Medium, because that is the shape many telemetry SDKs also exhibit.
What this does not claim: this is a proximity heuristic, not dataflow. It does not prove the harvested bytes reach the egress call, only that both capabilities are present and adjacent. A lone egress or a lone read must not fire here, because other detectors own those. The rule trades that proof for evasion-resistance and zero setup, and never certifies code safe. It walks JS/TS and Python files, skipping node_modules and vendored trees.
Remediation. Read both sites and establish whether the harvested value actually reaches the request. If it does, and the destination is not one you operate, treat the machine as compromised: rotate every token that was in the environment, then remove the dependency.
See also
- Confidence model - what
High,Medium, andLowmean for findings in this category. - Safety - what Vulkro does and does not access on your machine.
References
This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.