Malicious code in crypto-validate-lib (npm)

The 'crypto-validate-lib' npm package (versions 1.0.0, 1.0.1, 1.0.2, and 1.0.3) contains a self-invoking function that, shortly after loading, reads a base64-encoded payload from a disguised file, decodes it into JavaScript, writes it to a hidden directory in the user's home folder (~/.cache-db/.node-sync/syncd.js), and executes it as a detached Node.js child process. To maintain persistence, it installs a cron job on Linux systems that runs the payload every 12 hours and creates a scheduled task named 'WinNodeSync' on Windows to run it hourly. The naming of the hidden directory and scheduled task is intended to appear as legitimate Node.js caching, masking the malicious activity. This behavior has no relation to the package's stated function as a crypto address validator.

This malicious package can execute arbitrary code on the affected system with user-level privileges. It establishes persistence mechanisms on both Linux and Windows, enabling ongoing execution of the malicious payload. This can lead to unauthorized system compromise, potential data theft, or further malware deployment. The hidden nature of the files and tasks makes detection more difficult.

No official patch or remediation is currently available for this malicious package. Users should immediately remove 'crypto-validate-lib' versions 1.0.0 through 1.0.3 from their environments. Inspect and remove the hidden directory '~/.cache-db/.node-sync/' and delete the 'WinNodeSync' scheduled task on Windows or the corresponding cron job on Linux to eliminate persistence. Avoid using this package and verify the integrity of npm packages before installation.