Embedded Malicious Code Affecting @fairwords/loopback-connector-es package, versions =1.4.3=1.4.4
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-FAIRWORDSLOOPBACKCONNECTORES-15928203
- published8 Apr 2026
- disclosed8 Apr 2026
- creditUnknown
Introduced: 8 Apr 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the @fairwords/loopback-connector-es package.
Overview
@fairwords/loopback-connector-es is a Basic Elasticsearch datasource connector for Loopback.
Affected versions of this package are vulnerable to Embedded Malicious Code that mirrors the TeamPCP LiteLLM technique. What the postinstall payload does:
Harvests environment variables matching 40+ patterns (AWS, GCP, Azure, GitHub, OpenAI, Stripe, etc.)
Reads SSH keys, .npmrc, .kube/config, Docker auth, Terraform credentials, .git-credentials
Steals crypto wallet data - Solana keypairs, Ethereum keystores, MetaMask LevelDB, Phantom, Exodus, Atomic Wallet
Decrypts Chrome saved passwords on Linux using the well-known hardcoded PBKDF2 key ("peanuts" / "saltysalt")
Scans /proc/[pid]/environ for tokens in other running processes