Malicious code in dbt-language-server (npm)

The 'dbt-language-server' npm package version 1.0.1 declares a preinstall hook that runs 'node index.js' during installation. This script gathers reconnaissance data from the host system, including hostname, username, home directory, DNS servers, package metadata, and reads sensitive files like /etc/passwd and /etc/hosts. It then sends this data via HTTPS POST to a Burp Collaborator subdomain used for out-of-band exfiltration. The package lacks legitimate functionality and has empty author, description, and license fields. This behavior is consistent with a dependency confusion attack targeting organizations using dbt-related internal tools. The package compromises any system it is installed on.

Systems with this package installed should be considered fully compromised. Sensitive information and system files are exfiltrated to an attacker-controlled server. All secrets and keys stored on the compromised system are at risk and should be rotated immediately from a secure, unaffected system. Removing the package does not guarantee removal of all malicious artifacts or backdoors, as full control may have been granted to the attacker.

Immediate removal of the 'dbt-language-server' package version 1.0.1 is recommended. All secrets and credentials on the affected system should be rotated from a different, secure machine. Due to the potential full compromise, consider rebuilding or thoroughly auditing the affected system. No official patch or fix is available; remediation relies on removal and credential rotation.