Malicious code in @evial/runtime-health (npm)

The '@evial/runtime-health' npm package version 1.0.1 includes a postinstall script and main module that run a large JavaScript file mimicking lodash 4.17.21. Appended to this file is malicious code that queries cloud instance metadata service endpoints (AWS/Azure IMDS at 169.254.169.254, Aliyun at 100.100.100.200, Tencent Cloud at metadata.tencentyun.com) to gather cloud environment details. It also collects host system information such as hostname, user info, home directory, and network interfaces, and reads files under the user's home directory. This sensitive information is then sent via HTTP POST to a hardcoded collector IP address (10.100.0.46). The package's stated purpose and lodash disguise serve as cover for this exfiltration activity.

Sensitive cloud instance metadata, host identity details, and user home directory files can be exfiltrated to an attacker-controlled endpoint. This can lead to cloud credential compromise, unauthorized access, and potential further exploitation of the affected environment.

No official patch or remediation is currently documented. Users should immediately uninstall version 1.0.1 of '@evial/runtime-health' and avoid using this package. Monitor for any unauthorized access or data exfiltration attempts. Check vendor or repository advisories for updates or official guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.