Malicious code in cminhouse-api-gateway-nodejs (npm)

The malicious code in 'cminhouse-api-gateway-nodejs' is embedded in the package's postinstall script and main entry point. It avoids execution in CI/test/Docker environments by checking environment variables and presence of Docker. After a randomized delay, it collects a wide range of sensitive credentials from the user's home directory and environment variables. The collected data is base64-encoded and sent to a hardcoded VPS endpoint. Host reconnaissance data is also sent to a Telegram bot using a hardcoded token and chat ID. The behavior includes sandbox evasion, randomized delay, victim tagging, and use of a bare-IP exfiltration endpoint, consistent with a targeted supply-chain attack aimed at credential theft.

This malicious package compromises user credentials and secrets related to SSH, AWS, Azure, Google Cloud, Kubernetes, Docker, Terraform, GitHub, and other services. The exfiltration of these credentials can lead to unauthorized access to cloud resources, source code repositories, infrastructure, and other sensitive environments. The presence of victim tagging and sandbox evasion indicates a sophisticated attack designed to avoid detection and maximize data theft.

No official patch or remediation is currently documented. Users should immediately remove the affected versions (=999.0.0 and =999.0.1) of the 'cminhouse-api-gateway-nodejs' package from their environments. Avoid installing or using this package until a trusted, clean version is released. Review and rotate any potentially exposed credentials and secrets. Monitor for suspicious activity related to compromised credentials. Check vendor advisories or trusted security sources for updates on remediation.