Malicious code in @galicia-toolkit/tag-manager (npm)

@galicia-toolkit/tag-manager is a malicious npm package that abuses a postinstall hook to steal sensitive environment variables including AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, and ACTIONS_ID_TOKEN_REQUEST_TOKEN. It also collects detailed host reconnaissance data such as hostname, username, platform, architecture, kernel version, current working directory, user ID, external IP addresses, and CPU/memory information. This data is exfiltrated to a hardcoded external host via HTTP POST requests and DNS beaconing. The package versioning is artificially inflated (999.0.x) to win dependency resolution conflicts within the @galicia-toolkit scope. The package has no legitimate code in its main index.js and is solely intended for credential theft during installation. Despite a self-label as a bug bounty proof-of-concept, the behavior is malicious and compromises any system that installs it.

Systems that install this package are fully compromised as the package steals credential-grade environment variables and detailed host information, sending them to an attacker-controlled external server. This can lead to unauthorized access to cloud services, source code repositories, package registries, and CI/CD pipelines. The compromise extends beyond the package itself because attackers may use stolen credentials to deploy further malicious activities. Removal of the package does not guarantee remediation due to potential persistence mechanisms installed by the attacker.

Immediate removal of the @galicia-toolkit/tag-manager package versions 999.0.3, 999.0.5, and 999.0.6 is required. All exposed credentials and tokens (AWS, GitHub, NPM, Node Auth, Actions tokens) must be rotated immediately from a secure, uncompromised environment. Investigate the affected systems for additional persistence or backdoors, as full compromise is likely. Avoid installing packages from untrusted or suspicious sources, especially those with inflated version numbers or unexpected scoped names. Monitor dependency resolution processes to prevent dependency confusion attacks.