Malicious code in configration (npm)

The 'configration' npm package is a malicious package that mimics the 'configuration' package by a one-character omission in its name. Upon requiring the package and invoking its exported middleware, it detaches a child process that decodes a base64-obfuscated URL stored under decoy environment variable names. This child process sends the entire environment variables of the host process to a remote URL via a POST request with a custom header. The response from the remote server is executed as JavaScript code with access to Node's require function, enabling arbitrary remote code execution. This creates a combined credential exfiltration and remote code execution vulnerability triggered simply by loading the package.

This malicious package exfiltrates all environment variables, potentially including sensitive credentials, tokens, and CI secrets, to an attacker-controlled server. It also allows the attacker to execute arbitrary code on the victim's system with the privileges of the Node.js process loading the package. This can lead to full system compromise, data theft, and further attacks within the environment.

No official patch or remediation is currently documented. Users should immediately remove the 'configration' package from their dependencies and avoid installing similarly named or suspicious packages. Verify package names carefully before installation. Use trusted sources and package integrity verification tools. Monitor for any unexpected network activity or code execution related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.