The color-style-utils npm package versions 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, and 1.0.9 contain malicious code executed during all three lifecycle hooks (preinstall, install, postinstall). The postinstall.js script collects a wide range of sensitive data from the host environment, including SSH keys, AWS, Google Cloud, Azure credentials, npm configuration, Kubernetes, Docker configs, browser profiles, crypto wallets, VPN configs, shell histories, environment variables, and tokens for GitHub, AWS, Google, Stripe, Slack, and Discord. It also fingerprints the host's network and user environment and sends this data to a remote attacker-controlled endpoint via HTTPS. The package also declares a self-dependency and includes an undeclared sibling file with a non-standard filename, indicative of malicious name-squatting and decoy smuggling techniques.

This malicious package can lead to severe credential compromise across multiple cloud and service platforms, exposure of sensitive user and system configuration data, and potential unauthorized access to cloud resources, developer accounts, and cryptographic assets. The exfiltration of environment variables and tokens can facilitate further attacks or persistent access. Host fingerprinting enables targeted follow-up attacks. The presence of undeclared files and self-dependencies complicates detection and removal.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing color-style-utils versions 1.0.3 through 1.0.9. Remove any installations of this package immediately and rotate any potentially compromised credentials and tokens. Monitor for suspicious network activity related to the exfiltration endpoints described. Use trusted sources and verify package integrity before installation. Check vendor advisories or npm security advisories for updates or removal notices.