Malicious code in exodus-firestore-synchronize (npm)

The 'exodus-firestore-synchronize' npm package version 0.0.1 includes a postinstall hook that executes the 'whoami' and 'hostname' commands and scans environment variables for keys matching patterns related to tokens, secrets, keys, or authentication credentials. These values are printed to the installation output rather than sent over the network. The package masquerades as an internal Exodus Wallet SDK to exploit dependency confusion attacks, capturing sensitive environment data during installation. While no network exfiltration occurs in this version, the logging of credential-like environment variables can lead to exposure if installation logs are collected or archived, particularly in continuous integration environments.

Sensitive environment variables containing credentials or tokens may be exposed in installation logs due to the malicious postinstall script. This can lead to credential leakage if logs are accessible to unauthorized parties, especially in automated build or CI systems. There is no evidence of direct data exfiltration over the network in this package version.

No official patch or remediation is documented for this package version. Users should avoid installing 'exodus-firestore-synchronize' version 0.0.1 and verify the authenticity of packages, especially those mimicking internal dependencies. Review and restrict access to installation logs in CI environments to prevent credential exposure. Monitor for updates or advisories from the package maintainers or npm registry regarding this package.