The @aerodrome-finance/slipstream npm package, specifically versions 1.0.0, 1.1.0, and 1.1.1, contains malicious code embedded in its index.js file, which runs during preinstall and postinstall lifecycle hooks. Upon installation, it scans environment variables for keys matching credential-related patterns and reads sensitive secret files such as ~/.aws/credentials, SSH private keys, npm and Docker config files, and crypto wallet keystores related to Solana and Sui. The collected data is serialized and sent via a detached Node.js subprocess to a remote webhook URL after a randomized delay of 60 to 240 seconds. The malware includes sandbox evasion logic by detecting hostnames and usernames associated with analysis environments and aborts execution if detected. This package impersonates the Aerodrome Finance DeFi project to deceive developers in the crypto and DeFi space.

Sensitive credentials and secret files from the installer's environment can be exfiltrated to an attacker-controlled server. This includes cloud service credentials, SSH keys, npm tokens, crypto wallet keys, and other environment secrets, potentially leading to account compromise, unauthorized access, and theft of digital assets. The targeted nature of the harvested data indicates a high risk to developers working with crypto and DeFi technologies.

No official patch or remediation is currently available. Users should immediately uninstall the affected versions (=1.0.0, =1.1.0, =1.1.1) of the @aerodrome-finance/slipstream package and avoid installing it. Review and rotate any potentially exposed credentials and keys that may have been compromised. Monitor for suspicious activity related to these credentials. Use trusted sources and verify package authenticity before installation. Check for vendor advisories or updates for any official remediation guidance.