Malicious code in cacao1 (npm)

The 'cacao1' npm package at version 9.9.9 includes preinstall and postinstall lifecycle scripts that run index.js. This script reads the installer's hostname and sends it via an HTTP GET request to a hardcoded external URL (https://eo8f3m3ho26a0nm.m.pipedream.net/cacao1). The package has an empty description and a self-referential dependency, indicating it is not a functional library but rather a beacon designed to exfiltrate environment information. The OpenSSF Package Analysis project and Amazon Inspector flagged this package as malicious due to its communication with a domain associated with malicious activity.

Installing this package results in the installer's hostname being transmitted to a third-party server controlled by the package author. This can lead to privacy violations and potential reconnaissance by threat actors. There is no indication of further exploitation or code execution beyond this data exfiltration.

Avoid installing the 'cacao1' package version 9.9.9. Since no patch or remediation is available, users should remove this package if present and audit dependencies to prevent inclusion of this malicious package. Monitor package sources carefully to avoid dependency confusion attacks. No official fix is documented; users must rely on blocking or removing the package.