The malicious npm package @aerodrome-finance/contracts (versions 1.0.0, 1.1.0, and 1.1.1) impersonates the legitimate @aerodrome-finance scope. Its lifecycle hooks auto-execute an index.js script on installation that reads sensitive installer secrets from multiple well-known directories and environment variables containing keys or tokens. It then sends the collected data via HTTPS POST to a hardcoded webhook.site endpoint using a detached child process that delays sending to outlive installation and scanning windows. The code includes checks to evade sandbox, honeypot, and automated detection environments by inspecting hostnames, user privileges, environment variables, and npm registry mirrors. Static analysis confirms use of child_process, https, os, and fs modules to perform these actions.

This malicious package can lead to the compromise of a wide range of sensitive credentials and secrets stored on the victim's machine, including cloud service keys, SSH keys, Docker credentials, Git credentials, and various environment secrets. This exposure can result in unauthorized access to cloud resources, source code repositories, container registries, and other critical infrastructure. The stealth and evasion techniques increase the likelihood of successful undetected compromise during automated scans or sandbox analysis.

No official patch or remediation is available as this is a malicious package impersonating a legitimate scope. Users should immediately remove versions 1.0.0, 1.1.0, and 1.1.1 of @aerodrome-finance/contracts if installed. Audit systems for the presence of this package and any suspicious network traffic to unknown endpoints. Rotate any potentially exposed credentials and secrets stored on affected hosts. Use trusted sources and verify package authenticity before installation to avoid typosquatting attacks.