Malicious code in @hibachi-xyz/sdk (npm)

The '@hibachi-xyz/sdk' npm package at version 99.0.0 contains malicious code that runs immediately upon requiring the package. It scans environment variables for keys indicative of credentials (e.g., KEY, SECRET, TOKEN, PASS, AWS, GITHUB, DOCKER, KUBE), collects hostname and username, and executes commands ('whoami', 'id', 'cat /proc/1/cgroup') to fingerprint the user or container environment. The collected sensitive information is sent via a POST request to 'https://jorijo.xyz:8443/t' with TLS certificate verification disabled, allowing potential interception or man-in-the-middle attacks. This behavior is consistent with credential theft and environment reconnaissance. The package is likely a typosquatting attempt targeting the '@hibachi-xyz' namespace.

Sensitive environment variables containing credentials and tokens can be stolen, potentially leading to unauthorized access to cloud services, repositories, databases, and other resources. The fingerprinting commands reveal user and container details that can aid attackers in further exploitation or lateral movement. The use of disabled TLS verification increases the risk of data interception during exfiltration.

Users should immediately remove the '@hibachi-xyz/sdk' package version 99.0.0 from their projects. Avoid installing packages from untrusted or suspicious sources, especially those with unusual version numbers or typosquatting characteristics. Verify package authenticity before use. Since no official patch or fix is indicated, do not use this package. Monitor for any unauthorized access that might have resulted from exposure of credentials.