Malicious code in @fleetbo/svro (npm)

The @fleetbo/svro npm package versions 0.0.5 through 0.0.42 contain malicious code embedded in obfuscated JavaScript files (postinstall.cjs and cli.cjs). These files execute automatically on npm install via the postinstall lifecycle script, spawning child processes and making outbound HTTP POST requests. The obfuscation and behavior strongly indicate an install-time dropper or exfiltration malware. This automatic execution combined with network communication and process spawning at install time is inconsistent with legitimate package behavior and represents a severe security threat.

Any system that installs or runs the affected versions of @fleetbo/svro is considered fully compromised. The malicious code can execute arbitrary processes and communicate externally, potentially leading to data exfiltration and unauthorized control. All secrets and keys stored on the compromised system should be assumed exposed and must be rotated. Simply removing the package does not guarantee full remediation due to possible persistence or additional malware installed by the dropper.

Immediate removal of the @fleetbo/svro package is recommended. All secrets, credentials, and keys on affected systems should be rotated from a separate, uncompromised environment. Due to the nature of the compromise, a full system investigation and potential rebuild may be necessary to ensure complete remediation. No official patch or fixed version is available; users should avoid installing this package entirely.