How it was found

NOTE! Thanks for submitting a report! Please replace all the [square] sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report!

I would like to report the leak of environment variables in https://github.com/senecajs/seneca It make a user indavertely leak private credentials (such as AWS keys) to public spaces.

Module

module name: [MODULE NAME] version: [MODULE VERSION] npm page: https://www.npmjs.com/package/[MODULE NAME]

Module Description

A Node.js toolkit for Microservice architectures

Module Stats

Replace stats below with numbers from npm’s module page:

1711 downloads in the last day 7199 downloads in the last week 29241 downloads in the last month

Vulnerability

Vulnerability Description

Description about how the vulnerability was found and how it can be exploited, how it harms package users (data modification/lost, system access, other.

When a process using Seneca crashes, it prints out all of its environment variables. These are typically picked up by log monitoring system, and they might end up in less secured placed. As a result, it can end up in public bug reports, such as https://github.com/senecajs/seneca-transport/issues/88.

Steps To Reproduce:

var seneca = require('seneca')()
seneca.die()

Patch

diff --git a/lib/common.js b/lib/common.js
index ef3e398..e992cd6 100644
--- a/lib/common.js
+++ b/lib/common.js
@@ -339,10 +339,7 @@ exports.makedie = function(instance, ctxt) {
         process.arch +
         ', platform=' +
         process.platform +
-        (!full ? '' : ', path=' + process.execPath) +
-        ', argv=' +
-        Util.inspect(process.argv).replace(/\n/g, '') +
-        (!full ? '' : ', env=' + Util.inspect(process.env).replace(/\n/g, ''))
+        (!full ? '' : ', path=' + process.execPath)

       var when = new Date()

Supporting Material/References:

Wrap up

Select Y or N for the following statements:

• I contacted the maintainer to let them know: Y
• I opened an issue in the related repository: N

Hunter's comments and funny memes goes here

Impact

Access to cloud accounts. I got a 55$ bill out of this.