Malicious code in @galicia-toolkit-nestjs/commons (npm)

The @galicia-toolkit-nestjs/commons npm package includes a bundled ELF native binary loaded via a minimal index.js. This binary reads environment variables such as AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, NPM_TOKEN, and others, as well as hostname, username, and current working directory. It then sends this collected data via a raw socket POST request to the external host oob.s4yhii.com. The binary daemonizes itself to persist beyond the parent process. The package name is crafted to resemble an internal organizational package, likely to exploit dependency confusion attacks. No source code or build files for the native addon exist, preventing inspection or rebuilding. Multiple versions including 999.0.6, 999.0.7, 999.0.8, 999.0.1, and 3.0.1 are affected.

This malicious package can lead to credential theft by exfiltrating sensitive environment variables related to cloud services and CI/CD pipelines. Compromise of these credentials can enable unauthorized access to cloud resources, code repositories, and package registries. The persistence mechanism via daemonization increases the risk of prolonged unauthorized access. The package's deceptive naming increases the likelihood of accidental installation in internal environments.

No official patch or remediation is currently documented. Users should immediately remove the @galicia-toolkit-nestjs/commons package from their projects and dependency trees. Audit and rotate any potentially exposed credentials referenced in environment variables such as AWS, GitHub, NPM, and CI tokens. Avoid installing packages from untrusted or suspicious namespaces, especially those mimicking internal organizational scopes. Monitor for unexpected network connections to unknown external hosts. Check vendor advisories or trusted security sources for updates regarding this package.