Malicious code in @grab-food/order-sdk-web (npm)

The @grab-food/order-sdk-web package at version 49.9.9 is a hollow npm package that impersonates a legitimate brand but exports an empty object. Its sole dependency is pinned to [email protected], which is retrieved from a lookalike domain (https://registry.grivy-packages.com/) outside the official npm registry. Installing this package causes npm to fetch and install code from this attacker-controlled host, bypassing npm's registry inspection and enabling execution of arbitrary lifecycle scripts and code. This technique is a dependency-chain dropper, where the visible package is a lure and the actual malicious payload is delivered through the external dependency.

Installing @grab-food/[email protected] results in execution of attacker-controlled code fetched from an external, non-official source. This can lead to arbitrary code execution on the system performing the installation, potentially compromising the build environment or any systems that run the installed code. The malicious package bypasses npm registry protections by relying on an external tarball URL, increasing risk of supply chain compromise.

No official patch or fix is currently documented. Users should avoid installing @grab-food/[email protected]. Verify package sources carefully and do not install packages that depend on external tarball URLs outside the official npm registry. Use npm audit and supply chain security tools to detect and block such malicious packages. Monitor for updates from the npm registry or package maintainers regarding remediation.