Malicious code in grafeno-webhook (npm)

The 'grafeno-webhook' npm package version 1.0.0 includes a malicious preinstall.js script that runs automatically during installation. It collects environment variables containing sensitive keywords (AWS, TOKEN, KEY, SECRET, PASS, API), encodes them along with the host's hostname and username, and sends this data via curl to a hardcoded IP address (http://216.126.236.46/r.php) over plain HTTP. Additionally, on non-Windows platforms, it initiates an interactive bash reverse shell to the same IP on port 4444, granting the attacker full remote command execution capabilities on the compromised machine. This behavior enables attacker control and victim tracking.

Sensitive environment variables and host identifiers are exfiltrated to an attacker-controlled server, potentially exposing credentials and secrets. The reverse shell on non-Windows systems allows full remote command execution, leading to complete system compromise. This poses a critical risk to confidentiality, integrity, and availability of affected systems.

No official patch or remediation is currently documented. Users should avoid installing version 1.0.0 of 'grafeno-webhook'. Review and remove this package if already installed. Monitor for suspicious network connections to the IP 216.126.236.46 and investigate any unexpected reverse shell activity. Consider using trusted package sources and scanning dependencies for malicious code before installation.