Malicious code in digitalexp-style-module-l9 (npm)

The digitalexp-style-module-l9 npm package version 99.0.0 includes a beacon.js script triggered on both preinstall and postinstall phases of npm install. This script gathers sensitive system information (os.hostname(), os.userInfo().username, process.cwd(), and package name), encodes it, and sends it via DNS lookups segmented into <=60-character labels to the domain b0.rs. Additionally, it sends the same data in HTTPS GET requests to https://b0.rs. The DNS tunneling technique is explicitly chosen to bypass egress filtering in CI environments. The version number and behavior suggest this is a dependency confusion attack payload targeting internal name resolution. The presence of this package implies full system compromise.

Any system with this package installed is considered fully compromised. The attacker gains access to sensitive system information and potentially full control over the compromised machine. All secrets and keys stored on the system should be considered exposed and must be rotated immediately. Removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Immediate removal of the digitalexp-style-module-l9 package version 99.0.0 is required. All secrets and keys stored on the compromised system must be rotated from a separate, trusted environment. Due to the likelihood of full system compromise, a thorough incident response and forensic analysis should be conducted. There is no official patch or fix; remediation relies on removal and secret rotation.