The 'data-parser-utils' npm package version 3.0.2 imports the Node.js 'child_process' module and uses execSync to run bash and zsh commands that read and exfiltrate shell history files. These files often contain sensitive credentials, tokens, and connection strings. The malicious code is reachable from the package's main entry point, confirming that the package is designed to steal operational credentials from the host machine. The presence of this code matches known malware fingerprints for shell-history harvesting. This malicious behavior compromises the confidentiality of secrets stored on the affected system.

Systems with 'data-parser-utils' version 3.0.2 installed are fully compromised due to credential theft. Sensitive information such as credentials, tokens, and connection strings stored in shell history files may be exfiltrated by the malicious code. This can lead to unauthorized access to other systems and services. Because the package grants an attacker full control over the host, simply removing the package does not guarantee removal of all malicious artifacts or backdoors. Immediate secret rotation is required to mitigate ongoing risk.

No official patch or fix is currently available for this malicious package. The package should be immediately removed from all affected systems. All secrets, keys, and credentials stored on the compromised machines must be rotated from a separate, trusted environment. Because the attacker may have persistent access beyond the package itself, consider a full system compromise response including forensic analysis and system rebuild if warranted. Monitor for any signs of further compromise.