The 'chunk-parser' npm package version 1.0.0 masquerades as a legitimate Node.js chunk parser but contains a full remote-access trojan identified internally as 'runtimedev-link'. It downloads a portable Node.js 22.22.0 runtime to the user's local directory and runs a bundled agent CLI separate from the system Node.js. Persistence is established via Linux systemd user units, cron jobs, macOS LaunchAgents, and Windows Task Scheduler tasks, all configured to reinstall and auto-update the trojan at each boot/login. The trojan polls an operator-controlled API to receive shell commands, executes them, and returns output. It can exfiltrate arbitrary files up to 50MB by zipping and uploading them encoded to the operator. Additionally, it continuously reports host details, user information, public IP, home directory structure, and browser extension inventories to the attacker. This creates a persistent, stealthy backdoor with live auto-update capability.

This malicious package enables an attacker to gain persistent remote access to affected systems, execute arbitrary shell commands, and exfiltrate sensitive files and system information. The trojan collects detailed telemetry including user environment and browser extension data, potentially exposing user privacy and security. The live auto-update mechanism allows the attacker to modify payloads dynamically, increasing the threat's adaptability and risk. Systems running this package version are fully compromised while the trojan remains active.

No official patch or fix is currently available for this malicious package. Users should immediately uninstall 'chunk-parser' version 1.0.0 and remove all persistence mechanisms related to 'runtimedev-link' manually. Avoid installing or using this package from npm. Monitor for and delete any scheduled tasks, systemd units, LaunchAgents, or cron jobs named or related to 'runtimedev-link'. Since this is a malicious package, remediation involves removal and system cleanup rather than patching. Verify system integrity and consider incident response procedures to address potential compromise.