Malicious code in deposit-limit-fe (npm)

The deposit-limit-fe npm package, specifically versions 100.100.101, 100.100.102, and 100.100.106, masquerades as a legitimate frontend utility but contains a postinstall script that loads a silent native Linux x64 addon. This addon collects environment variables including HOSTNAME, USER, npm_package_name, and npm_config_registry, then forks a process to send this data via an HTTP POST request to a hardcoded IP address (64.181.165.115). The package exports an empty object and lacks source code for the native addon, indicating malicious intent. This exfiltration of private npm registry URLs and user environment details is a fingerprint of a dependency-confusion reconnaissance beacon, used to identify internal package names and environments.

Installing this package leaks sensitive environment information such as the installer's hostname, OS username, package name, and private npm registry URL to an attacker-controlled endpoint. This can lead to reconnaissance for further attacks, exposure of internal infrastructure details, and execution of opaque native code on the installer's machine, potentially compromising system integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal is confirmed, avoid installing the affected versions of deposit-limit-fe (100.100.101, 100.100.102, 100.100.106). Verify package authenticity before installation, especially for packages with unusual version numbers or unexpected postinstall scripts. Consider scanning installed packages for suspicious native addons and network activity. Use private npm registries with strict access controls and monitor for dependency confusion attacks.