The electron-orbit npm package, when imported, unconditionally initiates an auto-prefetch pipeline in Node.js contexts that opens a raw TCP socket to electronorbit.blob.core.windows.net on port 443. Instead of using standard HTTPS libraries, it implements a custom TLS 1.3 stack with XOR-obfuscated network strings to evade detection. During installation, it writes a marker file containing environment variables related to PATH and the current working directory, as well as system information in a decoy file. Upon require, it reads and encodes this marker data, appending it as a query string to the Azure blob URL, thereby exfiltrating environment details via HTTP request logs. The payload activates only if the SHA-256 hash of the environment variable BuildType matches a hardcoded substring, enabling stealthy, targeted activation. The package's claimed purpose of Electron runtime discovery is a cover for this malicious behavior.

This malicious package exfiltrates sensitive environment information, including PATH variables and working directory, to an attacker-controlled Azure blob storage endpoint. The use of a custom TLS stack and obfuscation techniques bypasses standard network inspection tools, increasing stealth. Activation gating by a specific environment variable hash enables targeted attacks, reducing detection risk. This can lead to exposure of sensitive build or runtime environment details, potentially aiding further attacks or reconnaissance.

No official patch or remediation is currently documented for this package. Users should avoid installing or requiring the electron-orbit npm package in their projects. Review dependency trees for inclusion of this package and remove or replace it with trusted alternatives. Monitor for any updates from the package maintainers or npm advisories for remediation guidance. Since this is a malicious package, the best mitigation is to prevent its use entirely.