Malicious code in @galicia-toolkit/error-master (npm)

The malicious npm package @galicia-toolkit/error-master version 999.0.3 executes a postinstall script that hex-encodes the installer's hostname, current working directory, platform/architecture/Node version, and environment variables related to user identity (USER/USERNAME/LOGNAME). It then sends this data via DNS queries to an attacker-controlled authoritative nameserver under the domain oob.s4yhii.com, effectively creating an out-of-band data exfiltration channel. The package name and version suggest it is crafted for dependency confusion attacks to supersede an internal package of the same name. The DNS beacon triggers automatically upon installation, leaking sensitive identifiers without any additional user action.

Any system that installs this package is considered fully compromised due to the exfiltration of sensitive environment and host information. The attacker gains knowledge of hostnames, user identities, and environment details, which can facilitate further attacks. Because the package may grant full control to an attacker, all secrets and keys stored on the compromised system should be rotated immediately from a separate, trusted system. Removing the package alone does not guarantee removal of all malicious components.

Remove the malicious package immediately. Rotate all secrets and keys that were stored or accessible on the compromised system from a different, secure computer. Because the package grants potential full control to an attacker, assume the system is fully compromised and consider rebuilding or isolating the affected host. Monitor for any signs of persistent malicious activity. There is no official patch or fix; remediation requires removal and secret rotation.