MAL-EXFIL Credential Harvest Next to Network Egress
The dominant npm-worm payload: code that harvests credentials or secrets sits next to a network call that can send them away. Either half alone is normal; together, in a repository the author controls, they describe exfiltration.
What Vulkro detects
MAL-EXFIL-001 fires when a harvest (a credential-file read, a bulk read of the process environment, or a named secret token) and an egress call (fetch, axios, requests.post, http(s).request, a webhook) fall within a few lines of each other in the same file. One finding per pair.
- High confidence: a credential-file or named-secret harvest.
- Medium confidence: a bulk
process.env/os.environread, which many telemetry SDKs also do.
This is a proximity heuristic, not data flow: it shows both capabilities are present and adjacent, not that the bytes reach the request. A lone read or lone egress never fires here. It scans JS/TS and Python files, skipping node_modules and vendored trees, and never certifies code safe.
How to fix
- Read both sites and check whether the harvested value reaches the request.
- If it does and the destination is not yours, treat the machine as compromised: rotate every token that was in the environment, then remove the dependency.
References
See also: Confidence model.
This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.