The 'ripshakti1' npm package version 81.0.0 declares a preinstall lifecycle hook that runs 'node index.js' on installation. This script queries the AWS EC2 instance metadata service (both IMDSv1 and IMDSv2) and ECS task credentials endpoints to gather IAM role credentials, instance identity, user-data, and network/host metadata. It also scans environment variables for keys matching patterns indicative of secrets (e.g., key, secret, token, pass, auth, cred, api, aws, database, mongo, redis, s3, sqs, sns, lambda, role). The collected data is base64-encoded and exfiltrated via HTTPS GET requests to a malicious Burp Collaborator subdomain controlled by the attacker. This malicious activity triggers automatically on every installation, including transitive installs and continuous integration runners. The package is flagged as malicious by the OpenSSF Package Analysis project and Amazon Inspector.

Sensitive AWS credentials and environment secrets can be stolen from any system where this package is installed, potentially leading to unauthorized access to cloud resources and data breaches. The automatic execution on install increases the risk of widespread compromise, especially in automated build and deployment pipelines.

No official patch or remediation is currently available for this package version. Users should avoid installing 'ripshakti1' version 81.0.0 and remove it from existing projects. Audit dependencies to ensure this package is not included transitively. Monitor for updates from the package maintainer or security advisories for any fixes or removals. Consider implementing supply chain security measures such as using trusted package registries, verifying package integrity, and restricting installation of untrusted packages.