Malicious code in @easy-entry/outside-registration-fop-navigator (npm)

The malicious npm package @easy-entry/outside-registration-fop-navigator (version 99.9.5) includes a postinstall hook that runs a script (scream3gg.js) and a curl command. This script hex-encodes and sends the host's hostname, home directory, and username to an attacker-controlled domain via HTTP fetch. Concurrently, the curl command exfiltrates the contents of the /etc/passwd file along with the hostname to another attacker-controlled domain. These actions occur automatically and unconditionally during the default installation process, resulting in the leakage of sensitive system information to the attacker.

Systems that install this package are fully compromised as sensitive information, including system user data and configuration files, is exfiltrated to attacker-controlled servers. The compromise may allow attackers to gain unauthorized access or further control over the affected system. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately from a different, trusted system.

There is no official patch or fix available. The package should be removed immediately from any affected system. Due to the severity of the compromise, it is recommended to consider the system fully compromised and to rotate all secrets and keys from a separate, secure environment. Monitor for any signs of persistent malicious activity and consider rebuilding the affected system if necessary.