Malicious code in ecobee-api (npm)

The 'ecobee-api' npm package (version 0.0.2) includes a postinstall lifecycle script that executes 'node beacon.js' upon installation. This script sends an HTTP GET request to a hardcoded IP address (http://169.58.96.170:9001/cb), transmitting the installer's hostname and package name as query parameters. The package lacks functional library code and is unlicensed, indicating it is a malicious package designed for reconnaissance or further compromise. The presence of this package on a system implies that the system may be fully compromised, as it allows remote operators to identify and potentially control the host.

Installation of this package results in execution of arbitrary code at install time, leaking system hostname and package information to an external attacker-controlled server. This compromises the confidentiality and integrity of the affected system. The attacker may have gained full control over the host, and all secrets and keys stored on the machine are at risk. Removal of the package alone does not guarantee eradication of all malicious artifacts.

Immediate removal of the 'ecobee-api' package version 0.0.2 is required. All secrets and keys stored on the affected system should be rotated from a different, trusted machine. Because the system may be fully compromised, a full forensic investigation and system rebuild are recommended. There is no official patch or fix; remediation involves removing the malicious package and mitigating any resulting compromise.