Malicious code in box-sign-client (npm)

[email protected] is a malicious npm package that acts as a dependency confusion attack vector targeting the internal Box namespace (@box/sign-client). Its package.json includes a preinstall script that executes node index.js, which reads the host's os.hostname() and environment variables USER or USERNAME. It then constructs a DNS query embedding these values into a subdomain of iv6mfybhp42k33ysmzi73de5w.canarytokens.com and triggers a DNS resolve call. This causes the installing system's hostname and user information to be transmitted to a third-party Canarytokens collector at install time, before any legitimate application code runs. This behavior leaks environment details to an external party on any npm install that mistakenly resolves this public package instead of the intended internal one.

The impact is the unintended disclosure of the installing system's hostname and user environment variables to an external third-party via DNS queries during package installation. This can lead to information leakage about internal hostnames and user identities. There is no indication of further code execution or system compromise beyond this data exfiltration. No known exploits in the wild have been reported.

No official patch or fix is available for this malicious package. The best mitigation is to ensure that internal packages are correctly namespaced and resolved, avoiding dependency confusion by verifying package sources before installation. Use package integrity verification and private registries to prevent accidental installation of malicious public packages impersonating internal ones.