The fhirproxy-utils package version 1.0.8 is malicious. Upon npm install and require(), it executes code that gathers extensive sensitive information from the host environment, including hostname, username, architecture, directory structure, network interfaces, DNS configurations, process lists, git configuration, CI/CD environment variables, and cloud metadata service tokens from AWS, Azure, and GCP. It performs DNS reconnaissance of internal hostnames to map internal networks. The collected data is base64-encoded, fragmented, and exfiltrated via HTTPS GET requests to a Cloudflare Workers endpoint. The package also declares binaries with names of common build tools (webpack, vite, tsc, jest, eslint, gulp, next, turbo, prettier) that run the malicious code before spawning the legitimate tool to mask its activity. This behavior leads to full compromise of affected systems.

Systems with fhirproxy-utils version 1.0.8 installed are fully compromised. The attacker gains access to sensitive environment and cloud metadata, potentially including IAM roles and temporary credentials. Internal network topology is mapped via DNS reconnaissance. Secrets, keys, and credentials stored on the compromised system are exposed and should be considered leaked. The malicious package can lead to persistent unauthorized access and further compromise beyond the initial infection.

No official patch or fix is currently available. The fhirproxy-utils package version 1.0.8 should be immediately removed from all systems. All secrets, keys, and credentials stored on affected systems must be rotated from a secure, uncompromised environment. Due to the extent of compromise, affected systems should be treated as fully compromised and undergo thorough incident response and remediation. Monitor for any suspicious activity related to the exfiltration endpoint and remove any related artifacts.