Malicious code in @galicia-toolkit/spa-build-config (npm)

The malicious npm package @galicia-toolkit/spa-build-config (versions 999.0.3, 999.0.5, 999.0.6) includes a postinstall script that automatically executes upon installation. This script collects extensive sensitive data from the host environment, including hostname, username, network interfaces, environment variables, and credential-grade tokens such as AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, and GitHub Actions OIDC tokens. The collected data is sent via HTTP POST to oob.s4yhii.com on port 9999 and beaconed via DNS lookups. The package's naming and versioning suggest it is a dependency confusion lure targeting internal scopes. The presence of this package grants attackers access to AWS accounts, GitHub repositories, npm publishing rights, and CI system tokens, effectively compromising the host system.

Installation of this package results in the exfiltration of sensitive credentials and environment data, potentially allowing attackers full control over AWS accounts, GitHub repositories, npm publishing capabilities, and CI/CD pipelines. Any system with this package installed should be considered fully compromised. Secrets and keys stored on the affected system are at risk and must be rotated immediately. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is indicated. Immediate removal of the package @galicia-toolkit/spa-build-config versions 999.0.3, 999.0.5, and 999.0.6 is recommended. All credentials and secrets exposed to the compromised system should be rotated from a secure, unaffected environment. Consider auditing systems for further compromise and unauthorized access. Monitor for any suspicious activity related to AWS, GitHub, npm, and CI/CD pipelines. Due to the severity of the compromise, assume full system compromise and respond accordingly.