Malicious code in @coopeuch/common (npm)

@coopeuch/[email protected] is a malicious npm package published under a scope the publisher does not own, leveraging dependency confusion by using an inflated version number (1.999.999) to override internal registry versions. Its postinstall.js script executes automatically on npm install, harvesting detailed environment data such as hostname, username, user IDs, home directory, network interface addresses, DNS resolver info, container and CI environment markers, npm registry configuration, and project package details. This data is sent as JSON to a hardcoded external endpoint (https://collector.oob.s4yhii.com/_npm-poc/beacon) and also triggers a DNS lookup beacon to a subdomain of oob.s4yhii.com. Any build resolving this package from the public npm registry risks leaking sensitive internal information to an unauthorized third party. Although the README labels this as a coordinated-disclosure proof of concept, the automatic data harvesting and exfiltration happen without installer consent.

This malicious package can lead to unauthorized disclosure of sensitive internal environment information including hostnames, usernames, MAC addresses, internal registry URLs, and project metadata. This information leakage can aid attackers in reconnaissance and further attacks against internal infrastructure. The exfiltration occurs silently during package installation, potentially affecting any build or environment that resolves this package from the public npm registry.

No official patch or remediation is indicated in the provided data. Users should avoid installing @coopeuch/[email protected] from the public npm registry. Verify and enforce strict package source controls to prevent dependency confusion attacks, such as using scoped registries and package allowlists. Monitor and audit package dependencies for unexpected versions or sources. Check vendor advisories or npm security notices for updates or official guidance.