Malicious code in @edgecommons/streamlog-node (npm)

The @edgecommons/streamlog-node npm package was published by a malicious actor impersonating an internal package namespace to exploit dependency confusion. It declares a preinstall hook that runs automatically during npm install, which installs @sentry/node and executes a script that initializes a Sentry client with a hardcoded attacker-controlled DSN. The script collects host telemetry, including the public egress IP (retrieved via Cloudflare's trace endpoint with a spoofed User-Agent), hostname, OS username, and runtime metadata, then triggers a runtime exception to send this data to the attacker's Sentry project. Each impersonated namespace in the campaign uses a distinct Sentry project ID to attribute successful installs to specific victim organizations. This package's payload is identical to a previous campaign ('click2ai'), sharing the same Sentry organization and maintainer identity, differing only in package name and target DSN. The attack is reconnaissance-focused, aiming to identify victims through telemetry beaconing rather than direct exploitation.

The package collects sensitive telemetry from the host environment at install time, including public IP address, hostname, OS username, and runtime environment details, and sends this information to an attacker-controlled Sentry endpoint. This can lead to organizational reconnaissance, allowing attackers to identify and profile victim environments. There is no indication of further exploitation or payload delivery beyond this telemetry beaconing. No known exploits in the wild have been reported.

No official patch or fix is available for this malicious package. The primary mitigation is to ensure that package resolvers are correctly configured to avoid dependency confusion attacks, such as by restricting installation of scoped packages to trusted registries and verifying package provenance. Organizations should audit their dependency configurations to prevent accidental installation of public packages impersonating private/internal namespaces. Monitoring for unexpected preinstall scripts and restricting execution of such scripts can also reduce risk.