Malicious code in argoncrypt (npm)

The 'argoncrypt' npm package (versions 1.2.1, 1.2.2, and 1.2.3) contains embedded malicious code that, when the package is required, spawns a detached Node.js child process executing a script that fetches additional code from a base64-encoded URL hosted on an anonymous static site. This fetched code is executed with full Node.js capabilities, including access to 'require', enabling arbitrary code execution with full host privileges. The package disguises itself as a pino logger transport to mislead reviewers. The external code fetch lacks integrity checks such as pinning, hashing, or signature verification, and retries the fetch up to five times. This behavior results in a full compromise of any system that installs or runs the package.

Systems that have installed or run the affected versions of 'argoncrypt' are fully compromised, as the package executes attacker-controlled code with full privileges. This can lead to unauthorized access, data exfiltration, and control over the host environment. All secrets and keys stored on the compromised system should be considered exposed and must be rotated from a secure environment. Removing the package alone may not eliminate all malicious artifacts due to the elevated access granted during execution.

Remove the 'argoncrypt' package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or accessible on compromised hosts from a secure, uncompromised environment. Due to the full system compromise risk, consider rebuilding affected systems to ensure complete removal of any persistent malicious code. There is no official patch or fix available; the package should be considered malicious and untrusted.