Malicious code in eslint-rxjs (npm)

The 'eslint-rxjs' npm package version 1.0.1 is a malicious package with inconsistent metadata designed to impersonate legitimate ESLint/RxJS packages. Its postinstall hook runs a script that unconditionally executes code on the installer's machine, issuing an HTTP GET request to a hardcoded ephemeral ngrok domain controlled by an attacker. This request discloses the installer's source IP and installation timing, indicating reconnaissance activity as part of a supply-chain dropper attack. The package ships no advertised functionality beyond this malicious beacon behavior.

Installation of this package results in remote code execution during the postinstall phase, allowing an attacker to confirm the presence of the package on a system and collect the installer's IP address and timing information. This compromises the confidentiality of the installer's environment and may serve as a precursor to further malicious activity in the supply chain.

No official patch or remediation is indicated. The package should be considered malicious and avoided. Users should remove any installations of 'eslint-rxjs' version 1.0.1 and audit their systems for any signs of compromise. Avoid installing packages with suspicious metadata or from untrusted sources. Monitor package dependencies carefully to prevent supply-chain attacks.