The eslint-helper package versions 4.0.1 and 4.0.2 are malicious. The package exports a from_str() function that recursively scans the current working directory for files commonly containing secrets (.env, config.toml, config.json, etc.) and sends their contents to a base64-obfuscated, hardcoded URL on vercel.app. Additionally, a helper function _gsh() reads multiple shell history files across different shells and executes shell commands to dump in-memory shell history, exfiltrating all collected data to the same endpoint. The use of base64 encoding for sensitive strings and the exfiltration endpoint demonstrates deliberate evasion and malicious intent. Installing or running this package compromises the host system, potentially exposing all stored secrets and shell histories to attackers.

Systems with eslint-helper versions 4.0.1 or 4.0.2 installed or running are fully compromised. Sensitive files containing secrets and configuration data, as well as shell command histories, are exfiltrated to an attacker-controlled server. This leads to credential leakage, potential unauthorized access, and loss of confidentiality. The compromise may extend beyond the package itself, as attackers could have established persistent control. Removal of the package alone does not guarantee full remediation.

No official patch or fix is currently available. Immediate removal of eslint-helper versions 4.0.1 and 4.0.2 from all systems is strongly recommended. All secrets and credentials stored on affected systems should be considered compromised and rotated immediately using a secure, unaffected environment. Conduct a thorough investigation for additional persistence or malicious artifacts beyond the package. Monitor for suspicious activity and consider rebuilding compromised systems if full trust cannot be established.