Malicious code in @avigilon/node-webrtc (npm)

The @avigilon/node-webrtc package declares a preinstall hook in its package.json that runs an index.js script upon npm install. This script collects host identifiers such as hostname, username, home directory, DNS servers, package path, and package.json contents, then exfiltrates this information via HTTPS POST to a hardcoded third-party domain (mj9ouelpgm0d26s3wp0syow03r9ix8lx.burp.attack.live). The package appears to be a malicious dependency confusion beacon targeting internal @avigilon/node-webrtc dependencies, with no legitimate functionality and no affiliation with Avigilon or Motorola infrastructure.

The malicious package can leak sensitive host environment information to an attacker-controlled server during installation. This reconnaissance data could be used to facilitate further attacks or compromise internal systems. There is no indication of active exploitation in the wild at this time.

No official patch or remediation is currently documented. Users should avoid installing versions 2.1.4 and 2.1.5 of @avigilon/node-webrtc. Verify package sources carefully to prevent dependency confusion attacks. Monitor for updates from the legitimate vendor or npm advisories for remediation guidance.