Malicious code in hemi-earn-actions (npm)

The 'hemi-earn-actions' npm package version 999.0.0 includes a preinstall script (postinstall.js) that harvests host metadata such as hostname, username, current working directory, and npm configuration. It scans environment variables for keys matching a regex pattern indicative of credentials (e.g., key, secret, token, password, private, ssh, deploy, auth, api, rpc, wallet, sentry, docker, graph, slack, host) and collects their values. This data is serialized into JSON and sent via HTTPS POST to a hardcoded IP address (https://185.130.46.35:8443/collect). The package exports an empty module and is described as an 'Internal package,' consistent with a dependency confusion attack vector that tricks organizations into installing a malicious public package instead of their private one. This results in automatic exfiltration of CI/developer secrets to attacker infrastructure upon installation.

Installation of this package leads to automatic exfiltration of sensitive environment variables and host metadata, including credentials and tokens, to an attacker-controlled server. This compromises the confidentiality of CI/CD secrets and developer credentials, potentially enabling further attacks or unauthorized access to organizational resources.

No official patch or remediation is currently documented. Users should avoid installing the 'hemi-earn-actions' package version 999.0.0 from the public npm registry. Organizations should verify their package resolution configurations to prevent dependency confusion attacks by ensuring private packages are resolved from trusted sources only. Monitor for unexpected packages in dependency manifests and audit environment variables exposed during builds. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.