Malicious code in box-sign-client-poc (npm)

The 'box-sign-client-poc' npm package version 1.0.0 declares a preinstall hook that executes index.js upon 'npm install'. This script reads the installer's hostname and OS username, embeds them with a timestamp into a DNS subdomain, and performs a DNS resolution to a canarytokens.com domain. This causes the installer's host and user information to be transmitted to a third-party collector, effectively exfiltrating sensitive environment details. The package appears to be a proof-of-concept for dependency confusion targeting a Box-branded internal package, but the exfiltration occurs on any machine that installs it.

Installation of this package results in the unintended disclosure of the installer's hostname and OS username to an external third-party domain. This could lead to privacy violations and potential reconnaissance by attackers. There is no indication of further exploitation or code execution beyond this data exfiltration.

No official patch or remediation is available. Users should avoid installing the 'box-sign-client-poc' package version 1.0.0. Since this is a malicious package, the best mitigation is to verify package authenticity before installation and avoid untrusted or proof-of-concept packages that may contain exfiltration code.