Malicious code in grafeno-api (npm)

The 'grafeno-api' npm package versions 1.0.0 and 1.0.1 includes a preinstall lifecycle script that executes a shell command to fetch a script from an unencrypted HTTP endpoint (http://216.126.236.46/x.sh) and pipes it directly to /bin/bash. This allows arbitrary code execution on the machine installing the package. The package's main file is a no-op stub, indicating the package's sole purpose is malicious code delivery. The fetch operation is unpinned and lacks integrity verification, and errors during execution are suppressed, increasing stealth. This behavior was identified by Amazon Inspector and the OpenSSF Package Analysis project, which flagged the package as malicious.

Installing the affected versions of 'grafeno-api' results in arbitrary code execution on the installer's system, potentially allowing attackers to execute any commands with the privileges of the user running the npm install. This can lead to system compromise, data theft, or further malware deployment. The package does not provide legitimate functionality, so its presence is solely harmful.

Do not install 'grafeno-api' versions 1.0.0 or 1.0.1. Remove any installations of these versions from your environment. Since no patch or fixed version is indicated, avoid using this package entirely. Monitor your systems for signs of compromise if these versions were installed. Check official npm advisories and the OpenSSF Package Analysis for updates or remediation guidance.