Malicious code in grafeno-auth (npm)

The 'grafeno-auth' npm package version 1.0.0 declares a preinstall hook that executes a shell command to curl a script from a bare IP HTTP endpoint (http://216.126.236.46/x.sh) and pipes it to sh, thereby running attacker-controlled code on the host during installation. Additionally, it appends a crontab entry to re-execute this script every 30 minutes, establishing persistent remote code execution. The package's index.js exports a no-op login function, indicating the lifecycle hook is the only active malicious component. This behavior was identified by Amazon Inspector and the OpenSSF Package Analysis project, classifying the package as malicious.

Installing the 'grafeno-auth' package version 1.0.0 results in execution of arbitrary attacker-controlled code on the host system at install time and persistently every 30 minutes thereafter via a cron job. This can lead to full compromise of the affected system, allowing the attacker to run any commands or payloads remotely. The malicious payload is mutable by the attacker, increasing risk over time.

No official patch or remediation is currently available for this package version. Users should avoid installing 'grafeno-auth' version 1.0.0. Remove any installations of this package and any associated cron jobs immediately. Monitor systems for unauthorized cron entries and network connections to the indicated IP address. Consider using trusted package sources and scanning dependencies for malicious behavior before installation.