Malicious code in grafeno-core (npm)

The 'grafeno-core' npm package (versions 1.0.0 and 1.0.1) includes a preinstall script that downloads and executes a shell script from a remote IP address over plain HTTP. This script is appended to ~/.bashrc and ~/.profile to maintain persistence and a cron job is installed to re-execute the payload every 30 minutes, ensuring ongoing unauthorized access. The package's main code is a stub, with the preinstall script constituting the entire malicious payload.

Systems installing 'grafeno-core' versions 1.0.0 or 1.0.1 will execute attacker-controlled code with the privileges of the installing user. This leads to persistent unauthorized access through shell profile modifications and scheduled tasks, potentially allowing further compromise or control of the host environment.

No official patch or remediation is indicated in the provided data. Users should avoid installing 'grafeno-core' versions 1.0.0 and 1.0.1. If already installed, remove the package, clean the ~/.bashrc and ~/.profile files of the malicious entries, and delete the malicious cron job. Monitor for any signs of compromise and consider rebuilding affected systems. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.