Malicious code in eip712-lite (npm)

The eip712-lite npm package versions 1.0.1 and 1.0.2 include an immediately invoked function expression (IIFE) that activates on require(). This function searches the installer's home and project directories for credential files and environment variables matching patterns related to private keys, tokens, AWS credentials, and other secrets. The collected data is gzip compressed, base64 encoded, and sent via a PUT request to a GitHub repository using a hardcoded bearer token that is XOR-obfuscated. After scheduling the data exfiltration, the malicious code overwrites itself in the package file to remove the payload, leaving only benign helper code, thereby evading detection. The exfiltration runs only once per machine, avoiding repeated detection and sandbox detonation. The package is advertised as a dependency-free EIP-712 helper, but this credential harvesting and exfiltration behavior is undocumented and malicious.

Systems with eip712-lite versions 1.0.1 or 1.0.2 installed are fully compromised. Sensitive credentials and secrets stored on the affected system, including AWS credentials, tokens, SSH keys, and other environment secrets, may have been exfiltrated to an attacker-controlled GitHub repository. This exposure can lead to unauthorized access to cloud services, source code repositories, and other critical infrastructure. Because the malicious code overwrites itself after execution and runs only once, detection is difficult. Removing the package does not guarantee removal of all malicious artifacts or backdoors, and secret rotation is mandatory to mitigate ongoing risk.

Immediate removal of the eip712-lite package versions 1.0.1 and 1.0.2 from all affected systems is required. All secrets and credentials stored on compromised machines must be rotated immediately using a separate, trusted device. Due to the high likelihood of full system compromise, a thorough investigation and potential system rebuild are recommended. There is no official patch or fixed version available; therefore, avoidance of this package and its versions is critical. Monitor for any suspicious activity related to credential misuse. Note that the malicious code avoids execution in CI and GitHub Actions environments and runs only once per machine, complicating detection.