Malicious code in bt2-api-gateway-node-js (npm)

The 'bt2-api-gateway-node-js' npm package at versions 999.0.0 and 999.0.1 contains a postinstall-triggered immediately-invoked function expression (IIFE) in its index.js that reads a wide range of installer-owned secrets from disk and environment variables. It collects SSH keys, AWS, Azure, Google Cloud, Kubernetes, Docker, GitHub, and other credentials, serializes and base64-encodes them, then sends the data via POST requests to two hardcoded destinations: a Telegram Bot API endpoint and an IP address (2.26.82.63) over unencrypted HTTP. The code delays execution randomly between 5 and 15 seconds and aborts if it detects test or CI environments or containerized environments to evade automated analysis. The package name and version suggest it is a dependency confusion attack vector targeting internal packages. The OpenSSF Package Analysis project and Amazon Inspector have flagged this package as malicious.

Users who install this package risk having sensitive credentials and secrets from their development and cloud environments exfiltrated to attacker-controlled endpoints. This can lead to unauthorized access to cloud accounts, source code repositories, databases, and other critical infrastructure. The exfiltration over plain HTTP exposes the data to network interception. The evasion techniques reduce the chance of detection during automated testing or sandboxing, increasing the likelihood of successful compromise in real environments.

No official patch or remediation is indicated for this malicious package. The best mitigation is to avoid installing 'bt2-api-gateway-node-js' versions 999.0.0 and 999.0.1. Users should audit their dependency trees to detect and remove this package if present. Additionally, users should rotate any potentially exposed credentials and secrets that may have been compromised. Monitor for suspicious network activity related to the described endpoints. Since this is a malicious package, no vendor fix exists; remediation involves removal and credential rotation.