Malicious code in ecobee2 (npm)

The 'ecobee2' npm package version 0.0.2 includes a post-install script ('beacon.js') that executes automatically during installation. This script performs an HTTP GET request to a hardcoded IP address (http://169.58.96.170:9001/cb), transmitting the installer's hostname and package name in the query string over cleartext HTTP. The package README does not document any legitimate reason for this network activity. The presence of this behavior indicates that the package is malicious and compromises the host system.

Installation of this package results in disclosure of host identity information to an external attacker-controlled server. The package is considered fully compromising the host, potentially allowing attackers full control. Any secrets or keys stored on the compromised system are at risk and should be rotated immediately. Removing the package alone may not eliminate all malicious components or backdoors introduced.

Remove the 'ecobee2' package immediately from affected systems. Consider all systems with this package installed as fully compromised. Rotate all secrets and keys from a separate, trusted system. Because the package grants potential full control to an attacker, a full system compromise response and forensic analysis are recommended. No official patch or fix is available; remediation involves removal and incident response.