The 'dlab_workshop' npm package (versions 1.0.1 to 1.0.7) includes malicious code in its index.js file that reads sensitive files from the user's home directory (~/.ssh/id_rsa, ~/.aws/credentials, .env files, etc.) and environment variables containing keywords like API, KEY, SECRET, TOKEN, PASS, AWS, GITHUB, SLACK, WEBHOOK, AUTH, CERT, PRIVATE. It then base64-encodes this data and exfiltrates it via HTTP POST requests to a hardcoded Burp Collaborator subdomain (oastify.com). The malicious payload is executed automatically through preinstall and postinstall npm lifecycle hooks and also when the package is required, indicating no legitimate functionality. The OpenSSF Package Analysis project flagged this package as malicious due to its communication with a domain linked to malicious activity.

Sensitive user secrets and credentials stored locally or in environment variables can be stolen by this package, potentially leading to unauthorized access to user systems, cloud accounts, and other services. The exfiltration of private keys and tokens poses a significant risk of credential compromise and further attacks. There is no indication of active exploitation in the wild yet.

Users should immediately remove the 'dlab_workshop' package versions 1.0.1 through 1.0.7 from their projects and systems. Avoid installing or requiring this package. Since no patch or fix is available, do not use this package until a trusted, clean version is released. Review systems for potential credential exposure and rotate any secrets that may have been compromised. Monitor for suspicious network activity related to the exfiltration domain.