The electron-orbit package for Node.js unconditionally triggers an auto-prefetch pipeline on require, opening a raw TCP socket to electronorbit.blob.core.windows.net:443 using a custom TLS 1.3 stack rather than standard HTTPS. It XOR-obfuscates all network-related strings to evade static inspection. During installation, it writes environment variables related to PATH and the current working directory to a temporary marker file, which is then read and encoded as a query string in the network request URL, effectively leaking environment details to the remote server. Activation is gated by checking if the SHA-256 hash of the BuildType environment variable is a substring of a hardcoded constant, enabling targeted payload execution. The package's claimed purpose of Electron runtime discovery is a decoy, as the icon-related functions return empty SVGs regardless of network responses.

This malicious package can exfiltrate sensitive environment information such as PATH variables and working directory details to a remote Azure blob storage endpoint. The custom TLS implementation bypasses standard TLS interception and static analysis, increasing stealth. The conditional activation allows the payload to remain dormant on most installations, reducing detection likelihood. This behavior can lead to information disclosure and potential further compromise depending on the environment data leaked.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal is confirmed, avoid using the electron-orbit package and audit your dependencies for its presence. Remove any installations of electron-orbit and monitor for unusual network connections to electronorbit.blob.core.windows.net. Consider using trusted package sources and scanning tools to detect malicious packages.