Malicious code in @easy-entry/routes (npm)

The @easy-entry/routes npm package version 99.9.5 includes a postinstall hook that executes commands to exfiltrate sensitive information. Specifically, it uses curl to send the contents of /etc/passwd to an attacker-controlled Burp Collaborator subdomain that includes the installer's hostname. Additionally, it runs a script that hex-encodes the hostname, home directory, and username, then sends this data via HTTP fetch to another attacker-controlled domain. The package is a malicious dependency designed for dependency confusion attacks and contains no legitimate code beyond the exfiltration payload.

Any system that installs or runs this package is considered fully compromised. The attacker gains access to sensitive system information and potentially full control of the affected machine. All secrets and keys stored on the compromised system should be rotated immediately from a secure, unaffected environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors installed as a result of this compromise.

Remove the @easy-entry/routes package version 99.9.5 immediately from all affected systems. Rotate all secrets, credentials, and keys that were stored or used on the compromised machines from a different, secure system. Conduct a thorough investigation and remediation of the affected environment, as full compromise is likely. There is no official patch or fix for this malicious package; prevention relies on avoiding installation and removing it if found.