The ecinc-cloud-moaxmpp npm package versions 9.7.1 and 9.7.2 contain embedded malicious code that performs unauthorized actions including accessing and encrypting Office documents, manipulating local storage, and executing arbitrary code. A key component is a native bridge that interacts with a mobile application's database, allowing raw SQL commands to be executed. This bridge is invoked when the JavaScript environment variable window.mappType is not 'web', indicating the code targets mobile app contexts. The malicious code leverages functions such as execute, rawQuery, rawInsert, rawUpdate, and rawDelete to perform direct database operations, posing significant risk to data integrity and confidentiality on affected mobile devices.

The malicious code can compromise data confidentiality and integrity by accessing and encrypting Office documents, clearing local storage, and executing arbitrary code. The ability to run raw SQL queries on a mobile device's database via a native bridge can lead to unauthorized data manipulation or exfiltration within the mobile application context. This poses a risk of data loss, corruption, or unauthorized disclosure on affected devices using the compromised package versions.

No official patch or remediation has been provided for this malicious package. Users and organizations should immediately discontinue use of ecinc-cloud-moaxmpp versions 9.7.1 and 9.7.2. Review and remove these versions from projects and dependency trees. Consider replacing the package with a trusted alternative. Monitor for any unusual database or application behavior on affected mobile devices. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates on remediation.