Malicious code in ecobee-home (npm)

The 'ecobee-home' npm package version 0.0.2 includes a postinstall script that automatically runs upon installation without user consent. This script executes 'beacon.js', which performs an HTTP GET request to a hardcoded bare-IP endpoint (http://169.58.96.170:9001/cb), transmitting the installer's hostname and package name as query parameters. This behavior constitutes host-identifier reconnaissance and exfiltration to an attacker-controlled endpoint. The package's placeholder README and lookalike name suggest it is designed for dependency confusion attacks or reconnaissance rather than legitimate telemetry. Systems with this package installed should be considered fully compromised.

Installation of this package results in immediate exfiltration of the installer's hostname to an attacker-controlled server, enabling reconnaissance. The package is considered fully compromising the affected system, potentially allowing attackers full control and access to all secrets and keys stored on the computer. Removal of the package alone does not guarantee eradication of all malicious components introduced.

No official patch or fix is available. Immediate removal of the 'ecobee-home' package version 0.0.2 is recommended. All secrets and keys stored on the affected system should be rotated from a separate, trusted machine. Due to the potential full compromise, a thorough security assessment and remediation of the affected system are advised.