Malicious code in gehneb (npm)

The 'gehneb' npm package (version 1.0.1) declares its 'consolefy' dependency as a GitHub repository URL controlled by an attacker, lacking commit SHA, tag, or branch pinning. This allows the attacker to modify the code at the repository's HEAD, which is cloned during 'npm install'. The package's library files require 'consolefy' at the module top level, causing any malicious code pushed by the attacker to execute on every installation and runtime. Indicators include empty description and author metadata, a short opaque package name, and republished dependencies under unrelated branding. This creates a silent remote code execution (RCE) channel on the installer's environment.

Any system with 'gehneb' version 1.0.1 installed or running is considered fully compromised. The attacker gains remote code execution capabilities during installation and runtime, potentially accessing all secrets and keys stored on the system. Removal of the package does not guarantee full remediation, as the attacker may have established persistent control or installed additional malicious software.

Remove the 'gehneb' package version 1.0.1 immediately from all affected systems. Rotate all secrets and keys from a separate, trusted environment. Since the attacker may have full control, conduct a thorough investigation and consider rebuilding affected systems. No official patch or fix is available; avoid using this package and monitor for any updates from the vendor or npm advisories.