Malicious code in grafeno-payments (npm)

The 'grafeno-payments' npm package version 1.0.0 includes a preinstall hook that automatically runs upon 'npm install'. This hook enumerates environment variables for keys containing AWS, TOKEN, KEY, SECRET, PASS, or API, concatenates these with the machine's hostname and username, base64-encodes the resulting data, and exfiltrates it via a curl GET request to a remote IP over plain HTTP. Furthermore, on non-Windows hosts, the script initiates an interactive bash shell redirected to the attacker's server on port 4444, granting the attacker full remote code execution capabilities on the compromised machine. The script suppresses errors to avoid detection during installation. The package's stated purpose as a payments tool is a cover for this credential theft and remote compromise.

Successful installation of this package leads to theft of sensitive environment credentials and system identifiers, which may include AWS keys and other secrets. Additionally, on non-Windows systems, attackers gain an interactive remote shell with the installer's privileges, enabling full control over the host system. This can lead to further compromise, data exfiltration, and persistence. The malicious activity occurs silently during package installation, increasing the risk of unnoticed compromise.

No official patch or remediation is currently documented for this package. Users should avoid installing 'grafeno-payments' version 1.0.0 from untrusted sources. Review and remove this package if already installed. Monitor for suspicious network connections to the indicated IP address and check for unexpected reverse shell activity. Consider rotating any potentially exposed credentials found in environment variables. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.