Malicious code in @easy-entry/landing-routes (npm)

The @easy-entry/landing-routes npm package version 99.9.5 includes a postinstall hook that performs two distinct data exfiltration actions. First, it uses a curl command to send the contents of the /etc/passwd file to a DNS-logging subdomain that encodes the victim's hostname. Second, a JavaScript script reads the operating system's hostname, home directory, and username, hex-encodes this information, and sends it via an HTTP fetch request to another attacker-controlled domain. Both exfiltration paths execute automatically during the default installation process without user consent. This behavior effectively compromises the host, exposing sensitive system information to attackers.

Any system that installs this package version is fully compromised due to the automatic exfiltration of sensitive system information and host identifiers. Attackers gain access to critical data such as user and system details, which can facilitate further attacks or unauthorized access. The compromise is severe enough that all secrets and keys on the affected system should be rotated immediately from a separate, secure machine. Removal of the package alone does not guarantee eradication of all malicious artifacts or backdoors introduced by the attacker.

Immediate removal of the @easy-entry/landing-routes package version 99.9.5 from affected systems is required. All secrets, credentials, and keys stored on the compromised system must be rotated from a different, trusted environment. Due to the high likelihood of persistent compromise, a full system reinstallation or forensic investigation is recommended to ensure complete remediation. There is no official patch or fix available; therefore, avoidance of this package version is critical.