Malicious code in grafeno-billing (npm)

The grafeno-billing package version 1.0.0 is a malicious npm package that executes a preinstall lifecycle script. This script enumerates environment variables filtering for keys containing AWS, TOKEN, KEY, SECRET, PASS, or API, concatenates these with the hostname and username, base64-encodes the data, and exfiltrates it via an HTTP GET request to a remote IP address (216.126.236.46). On non-Windows hosts, the script also initiates an interactive bash reverse shell to the same IP on port 4444 using /dev/tcp, granting the attacker remote command execution on the victim machine. The package's index.js is a stub returning a fake invoice result, confirming the package's sole purpose is to deliver this malicious payload.

Successful installation of [email protected] can lead to credential theft through environment variable exfiltration and remote code execution on non-Windows systems via a reverse shell. This compromises the confidentiality and integrity of the affected system and potentially allows full attacker control.

Avoid installing the grafeno-billing package version 1.0.0. Since no patch or fix is available, remove any installations of this package immediately. Monitor for and block network connections to the IP address 216.126.236.46. Use trusted sources and verify package authenticity before installation to prevent supply chain attacks.