Malicious code in grafeno-utils (npm)

The 'grafeno-utils' npm package version 1.0.0 includes a preinstall script that uses child_process to run a shell command which downloads and executes a script from a hardcoded IPv4 address (216.126.236.46) over plain HTTP without any integrity verification. This results in remote code execution at install time. Furthermore, the package appends a crontab entry to re-fetch and execute the same remote script every 30 minutes, providing persistent remote code execution capabilities on the affected system. The use of an unencrypted and mutable source for the script makes the system vulnerable to attacker control and compromise.

This vulnerability allows an attacker to execute arbitrary code on the system at the time of package installation and maintain persistent control through a scheduled cron job. The lack of encryption and integrity checks on the fetched script means the attacker can modify the payload at will, potentially leading to full system compromise of the host running the package installation.

No official patch or remediation is currently documented. Users should avoid installing version 1.0.0 of 'grafeno-utils'. Remove any installations of this package and associated cron jobs immediately. Monitor systems for unauthorized cron entries and unexpected network connections to the specified IP address. Since this is a malicious package, consider using trusted package sources and verifying package integrity before installation.