Malicious code in @hibachi-xyz/types (npm)

The '@hibachi-xyz/types' npm package version 99.0.0 masquerades as a type definitions package but contains malicious code that executes upon requiring the module. It enumerates environment variables filtering for keys related to secrets and credentials, collects OS hostname and username, and runs system commands to fingerprint the host and detect container or CI environments. The collected data is sent as JSON to a remote server over HTTPS with disabled TLS certificate verification, facilitating credential and host information exfiltration. The package's naming and versioning pattern suggest it is designed for dependency confusion or version squatting attacks.

This malicious package can lead to the exposure of sensitive environment variables, including secrets, tokens, and credentials, as well as system and user information. The exfiltration of this data to an attacker-controlled server can compromise the security of the affected system and any connected services that rely on these credentials. The disabled TLS verification increases the risk of interception or manipulation during data transmission.

No official patch or remediation is indicated for this package. Users should immediately remove '@hibachi-xyz/types' version 99.0.0 from their dependencies and avoid installing packages from untrusted or suspicious sources. Review dependency trees for unexpected or suspicious packages, especially those with unusual versioning or naming patterns. Employ supply chain security best practices such as verifying package provenance and using tools to detect malicious packages.