The 'habinger' npm package version 2.1.6 includes a postinstall hook that executes malicious actions upon installation. Specifically, on Linux, it fetches an SSH public key from a remote server and appends it to ~/.ssh/authorized_keys, then enables and configures the firewall to allow SSH connections, granting persistent unauthorized remote access. Concurrently, it searches for sensitive files such as 'id.json' (Solana CLI keypair), 'config.toml', and environment files, uploading them to attacker-controlled endpoints. It also retrieves scanning patterns to identify and exfiltrate additional files from the user's home directory on Unix or all logical drives on Windows, sending data with user and platform metadata to the attacker's server. This constitutes a severe compromise of affected systems.

Successful installation of the malicious 'habinger' package version 2.1.6 results in unauthorized persistent remote access on Linux hosts via SSH key injection and firewall modification. It also leads to the exfiltration of sensitive files including cryptocurrency keypairs and environment configurations, potentially exposing credentials and secrets. The recursive scanning and uploading of files from user directories or entire drives further increases data exposure risk. This compromises system confidentiality, integrity, and potentially availability if attackers leverage access for further malicious activities.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing 'habinger' version 2.1.6 from untrusted sources. If already installed, remove the package immediately, revoke any unauthorized SSH keys added to ~/.ssh/authorized_keys, and review firewall rules for unauthorized changes. Conduct a thorough investigation for potential data exfiltration and system compromise. Monitor for suspicious network connections to the indicated attacker IP addresses. Check vendor advisories or trusted security sources for updates or official remediation guidance.