Malicious code in hemi-supply-cron (npm)

The 'hemi-supply-cron' npm package (version 999.0.0) includes a preinstall hook that runs automatically on 'npm install'. This hook executes a script that gathers host identity details such as hostname, username, and current working directory. It enumerates environment variables, filtering keys with regex patterns targeting credential-like names (e.g., keys, secrets, tokens, passwords). The collected data is sent via HTTPS POST to a hardcoded IP address (185.130.46.35:8443) at the '/collect' endpoint. The package exports an empty object and lacks any legitimate library functionality. Its version number and naming suggest it is intended for dependency confusion attacks to override internal packages and steal secrets during installation or CI processes.

This malicious package can exfiltrate sensitive environment variables and host identity information from systems where it is installed. This includes credentials such as AWS keys, SSH tokens, API tokens, and other secrets present in environment variables. The compromise of these secrets can lead to unauthorized access to cloud resources, internal systems, and other sensitive infrastructure. There is no indication of active exploitation in the wild, but the potential impact of secret leakage is high.

No official patch or remediation is available for this package. The best mitigation is to avoid installing the 'hemi-supply-cron' package version 999.0.0 and to audit dependencies for suspicious or unexpected packages, especially those with unusually high version numbers or no legitimate functionality. Organizations should implement strict controls on package sources, use package allowlists, and monitor for dependency confusion risks. Review environment variables for potential exposure and rotate any secrets that may have been exposed if this package was installed.