The cr-bot-common npm package version 1.0.0 includes malicious preinstall.js and postinstall.js scripts that run automatically on installation. The preinstall.js script reads .env files and searches the working and home directories for files containing sensitive credentials such as private keys and wallet files. It also collects environment variables matching credential patterns. This data is sent via HTTPS POST to a malicious endpoint. The postinstall.js script further collects system information including hostname, user IDs, and cloud/container environment details, and reads sensitive files from key system directories before exfiltrating them to another malicious endpoint. The package attempts to hide its activity by printing a benign message and silently ignoring network errors.

Sensitive credentials and environment variables, including private keys, tokens, passwords, and cloud/container metadata, can be stolen from systems where cr-bot-common version 1.0.0 is installed. This can lead to unauthorized access to user accounts, cloud resources, and other sensitive systems. The malicious code executes automatically during installation without user consent or awareness, increasing the risk of widespread credential compromise.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing cr-bot-common version 1.0.0 and remove it if already installed. Review systems for signs of credential theft and rotate any potentially compromised secrets. Monitor for suspicious network connections to the indicated attacker domains. Consider using trusted package sources and scanning tools to detect malicious npm packages.