Malicious code in hyperliquid-composer (npm)

The hyperliquid-composer npm package (version 1.0.0) includes malicious code in its main executable (bin/cli.js) that gathers sensitive system information such as the installer's username (via 'whoami' and os.userInfo()), hostname, and platform details. This data is exfiltrated via an HTTP POST request to a hardcoded Cloudflare Workers URL (https://oobme.kunalsharma0553.workers.dev/r/7bq6fz3l15r9) immediately upon module import or CLI use, without any user notification or configuration options. The package name is crafted to resemble legitimate Hyperliquid tooling, increasing the risk of inadvertent installation. According to the ghsa-malware source, any system with this package installed should be treated as fully compromised, necessitating immediate secret/key rotation from a separate device. Due to potential deeper system compromise, simply uninstalling the package may not remove all malicious components.

Systems with hyperliquid-composer version 1.0.0 installed are at high risk of compromise. The malicious package exfiltrates sensitive system information silently and may allow attackers to gain full control over the affected computer. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure, unaffected device. Removal of the package alone does not guarantee elimination of all malicious artifacts or backdoors introduced by the attacker.

There is no official patch or fix available for this malicious package. The recommended mitigation is to immediately remove the hyperliquid-composer package version 1.0.0 from all affected systems. Treat any system with this package installed as fully compromised. Rotate all secrets, credentials, and keys from a separate, secure machine. Conduct a thorough security assessment of the affected systems to identify and remediate any additional malicious software or backdoors that may have been installed. Monitor for any suspicious activity and consider rebuilding compromised systems if necessary.