The @ceeferenderer/itg-renderer-sdk npm package (versions 9.9.0, 9.9.9, and 99.9.9) contains malicious code that executes during installation and import. It uses obfuscated JavaScript files and dynamic loading of core Node.js modules to gather sensitive information such as the OS username, hostname, and current working directory. This information is concatenated with a timestamp and sent as DNS queries to an attacker-controlled domain (oob.sl4x0.xyz), effectively leaking system identifiers. The package.json install script runs node index.js, which loads the malicious core.js. The author email and domain used for exfiltration are attacker-controlled. The package has no legitimate documented functionality and is considered a malicious package.

Any system that installs or imports this package is subject to silent data exfiltration of sensitive system identifiers. Because the package executes code on install and import, it can leak information without user awareness. According to the source, any computer with this package installed or running should be considered fully compromised, and all secrets and keys stored on that computer should be rotated immediately. Removal of the package does not guarantee removal of all malicious artifacts or backdoors, indicating potential persistent compromise.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove the package from all affected systems. Additionally, all secrets, keys, and credentials stored on compromised systems should be rotated from a separate, trusted environment. Systems suspected of compromise should be thoroughly investigated for additional malware or backdoors, as removal of the package alone may not restore system integrity.