Malicious code in grafeno-client (npm)

The 'grafeno-client' npm package version 1.0.0 includes a preinstall script that performs a curl request to a remote IP (http://216.126.236.46/x.sh) and pipes the response directly to the shell, enabling remote code execution on the system installing the package. Furthermore, the preinstall script appends a cron job that periodically fetches and runs the same remote script every 30 minutes, establishing persistence beyond the package lifecycle. The package's index.js file is a stub, meaning the malicious behavior is embedded entirely in the installation script rather than the package code itself.

This malicious package allows an attacker to execute arbitrary code on any system that installs 'grafeno-client' version 1.0.0. The cron job ensures ongoing compromise by repeatedly executing the attacker's script, potentially leading to full system compromise, data theft, or further malware deployment. The persistence mechanism survives package removal, increasing the risk and difficulty of remediation.

No official patch or remediation is currently documented for this package version. Users should avoid installing 'grafeno-client' version 1.0.0 from untrusted sources. If already installed, inspect and remove the malicious cron job and any downloaded scripts. Monitor systems for signs of compromise related to this package. Check for vendor advisories or npm security notices for updates or removal of the malicious package.