Malicious code in grafeno-pix (npm)

The 'grafeno-pix' npm package versions 1.0.0 and 1.0.1 include a preinstall hook that runs a command to download and execute a shell script from the IP address 216.126.236.46 over plain HTTP without integrity checks. This hook also installs a crontab entry that re-executes the remote script every 30 minutes, providing persistent remote code execution capability. The remote endpoint is unrelated to the package publisher and the content fetched is unverified, allowing arbitrary code execution with the privileges of the user installing the package. This behavior was identified by Amazon Inspector and the OpenSSF Package Analysis project, classifying the package as malicious.

Installation of these package versions results in arbitrary code execution on the host system during installation and persistently thereafter via a scheduled cron job. This can lead to full system compromise depending on the privileges of the installing user. The malicious code is delivered from an untrusted external source without integrity verification, increasing risk of further payload modifications or additional malware delivery.

Do not install or use 'grafeno-pix' versions 1.0.0 or 1.0.1. Remove any existing installations of these versions immediately and check for and delete the malicious cron job. Since no official fix or patch is indicated, avoid this package entirely or use a trusted alternative. Monitor for any unauthorized code execution or persistence mechanisms if these versions were installed.