Malicious code in bazelisk (npm)

This threat involves a malicious npm package named 'bazelisk' (version 1.0.0) that collides with the legitimate Google bazelisk project name. Upon installation, its postinstall script collects the installer's hostname, platform, architecture, Node.js version, package name, and npm lifecycle event, then sends this information as a JSON payload to an external URL unrelated to the legitimate publisher. This exfiltration of environment and host identifiers is characteristic of a dependency confusion beacon, used to gather intelligence on compromised environments.

The impact is limited to unauthorized collection and transmission of environment and host information from the machine where the package is installed. There is no indication of further malicious actions such as code execution beyond data exfiltration. This can lead to privacy breaches and potential reconnaissance for further attacks.

No official patch or remediation is indicated. Users should avoid installing the malicious 'bazelisk' package version 1.0.0 from untrusted sources. Verify package authenticity by checking publisher details and use official package repositories. Remove the package if already installed and monitor for suspicious network activity related to the indicated external URL.