The chart-data-utils package version 1.0.0 includes a postinstall.js script that executes at npm install time. This script performs host reconnaissance by gathering hostname, user identity, process lists, network configuration, and environment variables filtered for sensitive keys such as KEY, TOKEN, SECRET, NPM_TOKEN, AWS_, AZURE, GCP, GITHUB_TOKEN, and GitHub Actions identity fields. It also probes cloud metadata endpoints for AWS, Aliyun, GCP, Tencent, and an internal host. The collected information is base64-encoded and sent over plain HTTP to a hardcoded Burp Collaborator subdomain. The package is a malicious credential harvester disguised as a chart data/color helper library.

This malicious package can lead to the disclosure of sensitive credentials and environment variables, including cloud provider tokens and CI/CD pipeline secrets. The exfiltration of this data to an attacker-controlled server can enable unauthorized access to cloud resources, source code repositories, and other critical infrastructure. The reconnaissance performed may facilitate further targeted attacks.

No official patch or remediation is currently available. Users should immediately remove the [email protected] package from their projects and audit their environment for potential credential exposure. Avoid installing this package and verify the integrity of dependencies before use. Monitor for any suspicious outbound network traffic to unknown domains. Check vendor advisories or trusted security sources for updates on remediation.