The 'none123s' npm package versions including 0.1.0 through 1.1.7 (specific versions enumerated) contain a 'prepare' lifecycle script that runs on 'npm install'. This script reads private keys and credential files such as SSH keys, AWS credentials, Google Cloud credentials, npm and Docker configs, and environment variables. It sends this sensitive information to a hardcoded attacker-controlled ngrok domain. Additionally, it sends host metadata to the same domain to identify infected systems. The script suppresses errors to avoid detection. This is a supply-chain attack targeting developers and CI systems that install the package, resulting in credential theft and potential full system compromise.

Systems that install any affected version of the 'none123s' package are at high risk of credential theft, including SSH keys, cloud service credentials, and other sensitive configuration files. The attacker gains access to these secrets remotely, potentially leading to unauthorized access to cloud resources, code repositories, and other critical infrastructure. The presence of this package indicates a full compromise of the host environment. Removal of the package alone does not guarantee eradication of the attacker presence.

No official patch or fix is available for this malicious package. Immediate removal of the 'none123s' package from all systems is required. All credentials and secrets potentially exposed by the package must be rotated immediately using a trusted, uncompromised machine. Systems suspected of infection should be treated as fully compromised and undergo thorough investigation and remediation. Avoid installing packages from untrusted sources and verify package integrity before installation.