Malicious code in grafeno-config (npm)

The 'grafeno-config' npm package version 1.0.0 declares a preinstall lifecycle hook that runs a shell command fetching a script from the IP 216.126.236.46 over plain HTTP and pipes it to /bin/bash. This allows execution of arbitrary code controlled by the attacker at install time. Additionally, the package appends a crontab entry to re-execute the fetched script every 30 minutes, maintaining persistent remote code execution independent of the package's presence. The payload is unpinned and unverified, making it fully mutable by the attacker controlling the remote host.

This vulnerability allows an attacker to execute arbitrary code on the host machine during package installation and persistently thereafter via a scheduled task. This can lead to full system compromise, data theft, or further malware deployment. The attack does not rely on the continued presence of the package, increasing the risk of stealthy persistence.

No official patch or remediation is currently documented. Users should avoid installing 'grafeno-config' version 1.0.0. Remove any existing installations and inspect systems for the presence of the malicious crontab entry and any scripts fetched from the indicated IP address. Monitor and block network connections to 216.126.236.46 to prevent further payload retrieval. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.