Malicious code in exodus-payments (npm)

The exodus-payments package version 99.0.0-canary.1 includes a postinstall script (src/canary.js) that performs a DNS lookup and HTTPS GET request to a hardcoded Serveo tunnel host, transmitting only the package's name and version as query parameters. This design is intended as a dependency-confusion proof-of-concept canary to detect installation events by exposing the installer's public egress IP to the operator. No environment variables, credentials, filesystem contents, or other sensitive data are accessed or transmitted. The package README discloses this canary purpose. The main concerns are the outbound network call during installation without an opt-out mechanism, which can break air-gapped or sandboxed continuous integration environments, and the use of a third-party mutable tunneling service rather than publisher-controlled infrastructure. There is no evidence of credential theft, remote code execution, or persistence mechanisms.

The impact is limited to potential information leakage of the installer's public egress IP address during package installation. There is no credential theft, no remote code execution, and no persistence. However, the forced outbound network call may disrupt air-gapped or sandboxed CI/CD pipelines. The use of a third-party mutable tunnel endpoint introduces a risk of unintended data exposure or manipulation by the tunnel operator.

No official patch or fix is indicated. Users should avoid installing version 99.0.0-canary.1 of exodus-payments if they require strict control over install-time network activity or operate in air-gapped or sandboxed environments. Review package dependencies carefully and consider blocking or monitoring outbound network calls during installation. Since this is a proof-of-concept canary package, avoid using this version in production environments.