Malicious code in gaarf-bq (npm)

The npm package gaarf-bq version 1.0.0 includes a postinstall lifecycle script that collects installer host identifiers (os.hostname(), process.platform, process.arch, Node version, and package metadata) and transmits them via HTTPS POST to a hardcoded endpoint (vpx0x956.instances.poc.jchunt.top/gaarf-bq). This endpoint is not configurable by the user and is unrelated to the package's intended purpose. The package name mimics Google's ads-api-report-fetcher BigQuery component, suggesting it is designed to exploit dependency confusion to infiltrate internal builds and exfiltrate host fingerprints. Despite a self-description as a security-research canary, the behavior constitutes unauthorized data exfiltration.

The malicious postinstall script leaks sensitive host environment information to an attacker-controlled server without user consent. This can lead to privacy violations and potentially aid attackers in profiling or targeting affected systems. There is no indication of direct code execution beyond the data exfiltration, and no known exploits in the wild have been reported.

No official patch or remediation is currently available. Users should avoid installing version 1.0.0 of the gaarf-bq package from untrusted sources. Review and verify package authenticity before installation, and consider using package integrity verification tools or private registries to prevent dependency confusion attacks.