The fast-glob-fast package is a typosquatting malicious npm package that executes a postinstall script to compromise the host. The script determines the platform-specific path to the ~/.ssh/authorized_keys file, creates the ~/.ssh directory if missing, and appends a hardcoded SSH public key, enabling persistent remote access. It also collects system information such as username, hostname, MAC address, platform, and architecture. If the environment variable FAST_GLOB_FAST_EVENT_URL is set, it sends this information as a JSON payload to a remote URL, optionally including a Bearer token from FAST_GLOB_FAST_EVENT_TOKEN. This combination of SSH backdoor installation and host reporting constitutes a persistent remote access threat delivered through a typosquatting attack.

Systems that install the fast-glob-fast package version 9.0.0 or 11.0.0 may have an unauthorized SSH public key added to their authorized_keys file, allowing attackers with the corresponding private key to gain persistent remote access. The package also exfiltrates system identifiers to a remote server if configured, potentially exposing compromised hosts to the attacker. This compromises host confidentiality and integrity by enabling stealthy remote control.

No official patch or remediation is currently documented. Users should avoid installing the fast-glob-fast package, which is a known typosquatting malicious package. Remove the package if installed, and inspect and clean the ~/.ssh/authorized_keys file to remove the unauthorized SSH key. Monitor for suspicious environment variables (FAST_GLOB_FAST_EVENT_URL and FAST_GLOB_FAST_EVENT_TOKEN) and network connections related to this threat. Patch status is not yet confirmed — check vendor advisories or npm security advisories for updates.