Malicious code in exodus-checkout (npm)

The 'exodus-checkout' package on npm mimics an internal Exodus SDK API but contains no functional implementation; all exported functions throw errors. Upon installation, a postinstall hook triggers a DNS lookup and HTTPS GET request to a non-Exodus controlled SSH-tunnel domain, sending only the package's identity as a beacon. This indicates a dependency confusion style attack aimed at detecting unintended package resolution rather than causing direct harm. There is no evidence of data exfiltration or remote code execution capabilities in this package.

Any build that inadvertently includes 'exodus-checkout' from the public npm registry will fail at runtime due to all exports throwing errors. Additionally, the package installation emits a network beacon to a researcher-controlled external domain, which could raise privacy concerns but does not leak sensitive installer environment data or credentials. There is no active exploitation or data compromise reported.

No official patch or fix is documented. The best mitigation is to avoid resolving 'exodus-checkout' from public npm registries, especially by typo or dependency confusion. Review and lock dependencies to trusted sources and internal registries to prevent accidental inclusion. Since no sensitive data is exfiltrated and no remote code execution occurs, urgent remediation is not required.