Malicious code in global-intel (npm)

The 'global-intel' npm package version 1.0.1 declares a preinstall hook that runs a script (index.js) during 'npm install'. This script gathers host identity and OS files such as os.hostname(), os.userInfo(), homedir, DNS server configuration, /etc/passwd, /etc/hosts, and package metadata. It then sends this collected data via HTTPS POST to a hardcoded external domain (0gh240ybp2rb80iyzrg4w2o3tuzlncb1.oastify.com). This exfiltration occurs automatically without user interaction, resulting in a high risk of system compromise. The package is considered malicious, and any system with it installed should be treated as fully compromised.

Systems with 'global-intel' version 1.0.1 installed are at risk of full compromise due to automatic exfiltration of sensitive host and OS information during package installation. Attackers may gain access to secrets and keys stored on the compromised system. Removal of the package does not guarantee eradication of all malicious software introduced by the package.

Immediate removal of the 'global-intel' package version 1.0.1 is recommended. All secrets and keys stored on the affected system should be rotated from a separate, trusted device. Due to the potential full system compromise, consider rebuilding the affected system from a known good state. No official patch or fix is available; the package itself is malicious and should be avoided.