The 'cursed-modules' npm package (versions 2.0.0 and 999.0.0 to 999.0.3) is a malicious package that performs credential theft through install-time and require-time scripts. It collects sensitive files such as SSH private keys, npm and git configuration files, environment variables, and AWS credentials by querying the AWS instance metadata service and AWS Secrets Manager. The stolen data is exfiltrated via HTTP PUT requests to hardcoded attacker IP addresses. Execution is gated to trigger only when the hostname matches a Docker container ID pattern, targeting containerized CI/CD environments and avoiding detection in other environments. The package also attempts to harvest private npm registry credentials by reading Verdaccio configuration and htpasswd files. This package is part of a dependency confusion attack designed to shadow internal package names on the public npm registry and facilitate follow-on attacks.

Successful installation or inclusion of this package in a containerized CI/CD environment results in theft of sensitive credentials including SSH keys, npm and git configuration, environment variables, and AWS credentials. This can lead to unauthorized access to internal systems, private registries, and cloud resources. The attack is stealthy, activating only in container environments, which increases the risk of undetected compromise in automated build and deployment pipelines.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for current remediation guidance. Until then, avoid using the 'cursed-modules' package, especially versions 2.0.0 and 999.0.0 through 999.0.3. Implement strict controls on package sources and verify package authenticity to prevent dependency confusion attacks. Monitor for and remove any instances of this package in your environments.