The 'nonenull1' npm package (versions 1.0.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.2, 1.5.4, 1.5.5, 1.6.0) is malicious. It declares 'gypfile: true' with no native sources and uses binding.gyp to trigger 'node index.js' during npm's 'node-gyp rebuild' install step. The index.js script collects system and CI environment data and exfiltrates it via HTTP POST to a hardcoded ngrok domain controlled by the attacker. It also drops a file named 'GYP_STEALTH_PWNED.txt' to mark the compromise. This technique bypasses explicit lifecycle scripts, enabling stealthy automatic install-time remote code execution and data exfiltration.

This package enables automatic remote code execution during installation without explicit install scripts, allowing attackers to execute arbitrary code on the victim's system. It also collects and exfiltrates environment and installer information to an attacker-controlled server, potentially compromising sensitive CI environment data. This can lead to unauthorized access, data leakage, and further compromise of the development or deployment environment.

No official patch or remediation is currently documented. Users should avoid installing or using the 'nonenull1' package in any of the affected versions. Review dependency trees for this package and remove or replace it. Monitor for any unexpected files such as 'GYP_STEALTH_PWNED.txt' in build or workspace directories as an indicator of compromise. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.