Malicious code in cbc97b7a (npm)

The npm package 'cbc97b7a' versions =1.1787999566.0, =1.1787999998.0, =1.1788000497.0, =1.1788006723.0, =1.1788016922.0, and =1.1788423886.0 contains a malicious base64-encoded POSIX shell script embedded in the package.json description field. This script, when decoded and executed, downloads an xmrig Monero cryptominer from specified GitLab and GitHub repositories, installs cron-based persistence, and mines Monero to a hardcoded pool (xmr.kryptex.network:8029) with an embedded wallet/worker identifier. The script also uses multiple base64-encoded fallback C2 IP addresses for secondary fetches. The package contains no legitimate code files and is intended to be executed by a loader that fetches the package metadata and pipes the decoded description to a shell, delivering the miner installation and persistence mechanisms. Systems with this package installed are fully compromised.

Systems with this package installed are fully compromised, as the malicious script installs a cryptominer with persistence mechanisms and connects to external mining pools and command-and-control servers. This can lead to unauthorized resource consumption, potential data exposure, and loss of control over the affected system. All secrets and keys stored on compromised systems should be considered exposed and rotated immediately from a different, uncompromised machine. Removing the package alone may not remove all malicious components due to persistence.

Immediate removal of the 'cbc97b7a' package is recommended. However, because the package installs persistent cryptomining malware and potentially other backdoors, affected systems should be considered fully compromised. All credentials and secrets stored on the system must be rotated from a separate, clean environment. A full system investigation and remediation, including reimaging if necessary, should be conducted. No official patch or fix is available; mitigation relies on removal and incident response.