Malicious code in evilpostinstall (npm)

The 'evilpostinstall' npm package version 4127000.0.1 and other specified versions execute a postinstall script that pipes the output of the environment variables through 'nc' (netcat) to a host IP address reconstructed from the package version string. This results in exfiltration of the full installer environment, including any CI secrets, tokens, and API keys present in environment variables, over TCP port 888. Additionally, the package.json declares a self-referencing dependency with a version encoding a second destination IP, triggering further exfiltration. The obfuscation technique of reconstructing the destination IP from the version string hides the malicious intent from static scanners. No source files are shipped, making the manifest the sole carrier of the malicious payload.

Sensitive environment variables, including CI secrets, tokens, and API keys, are exfiltrated to attacker-controlled IP addresses during package installation. This can lead to credential compromise and unauthorized access to systems or services that rely on these secrets. The obfuscation of the exfiltration destination complicates detection and mitigation.

No official patch or remediation is indicated in the provided data. Users should avoid installing the 'evilpostinstall' package and any of its versions listed as affected. Since the malicious behavior occurs during 'npm install', auditing dependencies and using trusted package sources is critical. Monitor for and remove any instances of this package from projects. Check vendor advisories or npm security advisories for updates or removal notices.