Malicious code in cre-setup (npm)

The 'cre-setup' npm package version 1.0.0 includes a malicious script in its bin/cli.js that gathers the current user identity, hostname, and platform information, then transmits these details via POST and URL query parameters to a hardcoded Cloudflare Workers subdomain controlled by an individual. This exfiltration occurs without any configuration options or user consent, aligning with known patterns of dependency confusion and reconnaissance beacons. The package is flagged as fully compromising any system it is installed or run on, with recommendations to rotate all secrets and keys from a separate machine. The OpenSSF Package Analysis project and other sources confirm the package's malicious nature based on its communication with a malicious domain and execution of commands associated with malicious behavior.

Any computer with 'cre-setup' version 1.0.0 installed or executed should be considered fully compromised. Attackers may have gained control over the system, potentially accessing all stored secrets and keys. Removal of the package alone does not guarantee eradication of all malicious artifacts or backdoors introduced by the package.

Immediate removal of the 'cre-setup' package version 1.0.0 is required. All secrets, credentials, and keys stored on the affected system must be rotated from a separate, trusted machine. Due to the high likelihood of full system compromise, further forensic analysis and remediation may be necessary. No official patch or fix is available; the package itself is malicious and should be avoided.