Malicious code in @across-toolkit/eslint-config (npm)

The '@across-toolkit/eslint-config' npm package versions 99.0.0 and 99.0.1 include a postinstall.js script that runs automatically upon installation. This script collects a wide range of sensitive data from the host environment, such as AWS credentials (~/.aws/credentials, AWS IMDS queries), GCP credentials (metadata service queries, gcloud tokens), SSH private keys (~/.ssh/id_rsa, id_ed25519), npm and git configuration files, environment variables including tokens (NPM_TOKEN, GITHUB_TOKEN, Actions OIDC tokens), and system information (hostname, whoami). The collected data is base64-encoded and sent via HTTPS POST to a hardcoded webhook URL. The package name and versioning suggest it is crafted for dependency confusion attacks against the Across Protocol namespace. This behavior was identified by Amazon Inspector and the OpenSSF Package Analysis project, which classified the package as malicious.

Installation of these package versions results in unauthorized exfiltration of sensitive credentials and environment data from the user's system to an external attacker-controlled endpoint. This compromises cloud credentials (AWS, GCP), SSH keys, npm and git tokens, and potentially other secrets, leading to significant risk of account takeover, unauthorized access, and further compromise of development and deployment environments.

No official patch or remediation is currently documented. Users should immediately avoid installing or using '@across-toolkit/eslint-config' versions 99.0.0 and 99.0.1. Remove these versions if already installed and rotate any potentially exposed credentials and tokens. Monitor for suspicious activity related to compromised credentials. Check vendor advisories or trusted security sources for updates or official fixes. Consider using package integrity verification and dependency allowlists to prevent installation of malicious packages.