Malicious code in @hibachi-xyz/config (npm)

The '@hibachi-xyz/config' npm package at version 99.0.0 contains malicious code that, when loaded, scans environment variables for keys resembling credentials (e.g., KEY, SECRET, TOKEN, PASS, AWS, GITHUB, DOCKER) and collects their values. It also runs system commands ('whoami', 'id', and 'cat /proc/1/cgroup') to gather user and container-related information. The collected data is compiled into a JSON payload and sent via an HTTPS POST request to a remote endpoint (https://jorijo.xyz:8443/t) with TLS certificate verification disabled (rejectUnauthorized:false), increasing the risk of man-in-the-middle attacks. The package appears to be a malicious typosquat or scope hijack of legitimate hibachi packages, leveraging version inflation (99.0.0) to appear distinct.

This malicious package can exfiltrate sensitive environment variables that may contain credentials or secrets, potentially compromising user accounts, cloud services, and other integrated systems. The execution of system commands can reveal user and container context, aiding attackers in further exploitation or lateral movement. The use of disabled TLS verification weakens transport security, increasing the risk of interception of the exfiltrated data.

No official patch or remediation is currently documented for this malicious package. The best mitigation is to avoid installing or using '@hibachi-xyz/config' version 99.0.0. Users should verify package authenticity and source before installation, prefer official and verified packages, and monitor dependencies for suspicious or unexpected additions. Remove the package if already installed and rotate any potentially exposed credentials.