The 'kecak256' npm package is a malicious typosquat of the legitimate 'keccak256' package. It mimics the legitimate package's author and README to deceive users. The package.json defines a postinstall script that runs obfuscated JavaScript code (init.m.js) which launches a hidden process (upchk.m.js). This second stage script checks for administrative privileges, targets browser credential stores (e.g., Chrome's Login Data), archives stolen data into a zip file, and exfiltrates it in 5MB chunks to a runtime-decoded C2 URL using axios and FormData. The package dependencies include archiver, axios, and form-data to facilitate this exfiltration. The affected versions are 1.0.0, 1.0.1, 1.0.2, and 1.0.5. The package is not a cloud service, and no official patch or fix is indicated. The threat represents a supply chain compromise risk through typosquatting and credential theft.

Systems that have installed the 'kecak256' package are at high risk of credential theft and full compromise. The malicious payload steals browser and credential store data, including sensitive login information and application keys, archives it, and exfiltrates it to an attacker-controlled server. This can lead to unauthorized access, data breaches, and further compromise of the affected systems. Because the package runs code automatically on installation with elevated privileges, the attacker may gain persistent control over the system. Secrets and keys stored on compromised machines should be considered exposed and rotated immediately.

No official patch or fix is currently available for this malicious package. The recommended mitigation is to immediately remove the 'kecak256' package from all affected systems. Because the package executes a credential-stealing payload on install, any system with this package installed should be considered fully compromised. All secrets, credentials, and keys stored on these systems must be rotated from a trusted, uncompromised environment. Monitor for any suspicious activity related to credential misuse. Avoid installing packages with names similar to popular libraries to prevent typosquatting attacks.