Malicious code in fieldbase-webapplication-buildtools (npm)

The 'fieldbase-webapplication-buildtools' npm package at version 99.99.99 declares preinstall and install lifecycle scripts that automatically execute upon 'npm install' without user interaction. These scripts gather the installer's username (via 'whoami'), hostname, current working directory, and the npm package name, then base64-encode this information. The encoded data is exfiltrated to a hardcoded domain (https://eoy34oyrep9j5x8.m.pipedream.net) through both an HTTPS GET request and a DNS lookup (nslookup) to a subdomain of the same host. The version number and package name pattern suggest this package is a dependency confusion lure designed to trick internal package resolution mechanisms. The OpenSSF Package Analysis project flagged this package as malicious due to its communication with a domain linked to malicious activity and execution of commands associated with malicious behavior.

This malicious package can leak sensitive environment information from the system where it is installed, potentially exposing user identity and system details to an attacker-controlled endpoint. This can lead to further targeted attacks or reconnaissance. The automatic execution of these scripts during installation means that any user or system installing this package is at risk of data exfiltration without explicit consent or awareness.

No official patch or remediation is currently documented for this package. Users should avoid installing 'fieldbase-webapplication-buildtools' version 99.99.99 or any similarly suspicious packages, especially those with unusual version numbers or unknown sources. Verify package authenticity and source before installation. Employ strict package source controls and dependency resolution policies to prevent dependency confusion attacks. Monitor and audit package dependencies regularly.