Malicious code in 0vulns-dependency-confusion-poc (npm)

The '0vulns-dependency-confusion-poc' npm package includes a preinstall script that executes a wget command targeting an attacker-controlled webhook.site URL, sending system information (user, directory, hostname) as query parameters. This script runs automatically on 'npm install' with unsafe permissions enabled, facilitating credential and telemetry exfiltration. The package tarball contains only a package.json file with no main entrypoint or legitimate functionality, indicating it is designed solely to trigger malicious beaconing. The package poses a high risk of system compromise, especially if installed unintentionally via dependency confusion attacks.

Systems that install this package are considered fully compromised. The malicious script can exfiltrate sensitive system information and potentially allow attackers to gain control over the affected computer. All secrets and keys stored on the compromised system should be rotated immediately from a secure environment. Removing the package alone may not eliminate all malicious artifacts or backdoors introduced by the package installation.

There is no official patch or fix available for this package. The primary mitigation is to avoid installing this package entirely. If the package has been installed, remove it immediately and assume the system is compromised. Rotate all secrets and keys from a different, secure system. Conduct a thorough investigation and remediation of the affected system, as removal of the package does not guarantee full cleanup of malicious components.