Malicious code in electro-session (npm)

The npm package [email protected], 0.1.1, 0.1.3, and 0.1.4 masquerades as a session utility but contains ~1MB of heavily obfuscated JavaScript designed to steal sensitive data. It leverages Node.js built-in modules such as sqlite, fs, os, path, child_process, and crypto, combined with the @vercel/blob SDK to upload stolen data to the cloud. The obfuscation includes RC4-encrypted strings and anti-analysis wrappers. The malware reads local SQLite credential/session stores (e.g., browser login data, cookies, wallet extensions), decrypts them using OS primitives invoked via child_process, and uploads them. Persistence is achieved by registering recurring OS tasks that re-invoke the payload. The payload activates when the CLI is run with user confirmation or when the Sessions module is instantiated programmatically. The bilingual prompt (English and Spanish) suggests targeting Spanish-speaking developers.

This malicious package can exfiltrate sensitive user credentials and session data from local SQLite databases used by browsers, wallet extensions, and chat applications. The data is decrypted and uploaded to a cloud service, potentially leading to credential theft, account compromise, and privacy violations. The persistence mechanism allows repeated data theft over time. This poses a significant risk to developers and users who install or require this package.

No official patch or remediation is currently documented. Users and developers should immediately remove and avoid using electro-session versions 0.1.0, 0.1.1, 0.1.3, and 0.1.4. Audit systems for the presence of this package and any scheduled tasks it may have created. Replace the package with trusted alternatives and monitor for unauthorized data exfiltration. Check vendor advisories or trusted security sources for updates or official guidance.