Malicious code in @hibachi-xyz/ui (npm)

The '@hibachi-xyz/ui' npm package at version 99.0.0 masquerades as a UI component library but executes malicious code upon require. It enumerates environment variables that match broad credential-related regex patterns, collects hostname and username, and runs system commands ('whoami', 'id', 'cat /proc/1/cgroup') to fingerprint the environment. The gathered information is sent as a JSON payload to a hardcoded endpoint (https://jorijo.xyz:8443/t) with TLS verification disabled (rejectUnauthorized:false), increasing the risk of interception. This package appears to be part of a dependency confusion attack targeting the '@hibachi-xyz' scope.

The malicious package can exfiltrate sensitive environment variables potentially containing credentials or secrets, as well as system and container fingerprinting data. This can lead to credential leakage and further compromise of the host or container environment where the package is installed. The disabled TLS verification increases the risk of man-in-the-middle interception of the exfiltrated data.

No official patch or remediation is currently available. Users should immediately remove or avoid using '@hibachi-xyz/ui' version 99.0.0. Verify dependencies to ensure no malicious packages are included, especially from untrusted or unexpected sources. Monitor for any unauthorized access or credential misuse. Check vendor advisories or npm security advisories for updates or removal notices regarding this package.