Malicious code in @coopeuch/button (npm)

The @coopeuch/button npm package version 1.999.999 includes a postinstall lifecycle script (postinstall.js) that executes automatically during npm install. This script collects detailed host information such as hostname, username, user IDs, home directory, network interfaces with MAC addresses and CIDRs, DNS server configurations, reverse DNS internal FQDN, CPU and memory details, package metadata, CI environment markers, npm configuration variables, and container runtime indicators. The collected data is sent as a JSON payload via HTTPS POST to a hardcoded external server (collector.oob.s4yhii.com) and also triggers a DNS lookup to the same domain as an out-of-band beacon. The package's version and scope suggest it is designed for dependency confusion attacks, substituting a public package for an intended internal one to exfiltrate sensitive environment information.

This malicious package can lead to unauthorized disclosure of sensitive host and environment information to an attacker-controlled external server. The data collected includes identifiers and configuration details that could facilitate further targeted attacks or reconnaissance against the affected organization. The attack leverages dependency confusion to trick internal users into installing the malicious package instead of the legitimate internal package, increasing the risk of exposure.

No official patch or remediation is currently documented. Users should avoid installing the @coopeuch/button package version 1.999.999, especially in environments where dependency confusion is possible. Organizations should audit their npm dependencies and internal package namespaces to prevent public packages from masquerading as internal ones. Implementing strict package resolution policies and verifying package sources can help mitigate this risk. Monitor for unexpected network connections during npm installs and consider restricting outbound connections during package installation processes.