Malicious code in forge-extended (npm)

The 'forge-extended' npm package version 1.0.1 includes a preinstall lifecycle script that automatically executes upon installation. This script gathers detailed system information such as os.hostname(), os.userInfo().username, home directory, DNS server list, and reads sensitive files /etc/passwd and /etc/hosts. It then transmits this aggregated data as a JSON payload to a Burp Collaborator subdomain under oastify.com, an out-of-band reconnaissance endpoint unrelated to the package's intended use. This behavior constitutes a malicious backdoor and reconnaissance beacon, indicating a dependency confusion or supply chain attack vector. The package compromises the host system, potentially granting attackers full control.

Systems with 'forge-extended' version 1.0.1 installed are fully compromised due to the exfiltration of sensitive system information and potential backdoor access. All secrets, credentials, and keys stored on the affected system should be considered compromised and require immediate rotation. The malicious code executes automatically during installation without user interaction, increasing risk of unnoticed compromise. Removal of the package alone may not remove all malicious components introduced, implying persistent threat presence.

No official patch or fix is currently documented for this malicious package version. Immediate mitigation involves uninstalling the 'forge-extended' package version 1.0.1 from all affected systems. Due to the high likelihood of full system compromise, all secrets and credentials on the affected machines must be rotated from a separate, trusted environment. Comprehensive system audits and potential reimaging of affected hosts are recommended to ensure removal of any persistent malicious artifacts. Monitor for any network communications to suspicious domains such as oastify.com and block them if possible.