Malicious code in hyperpure (npm)

The 'hyperpure' npm package version 1.0.0 includes a preinstall lifecycle script that runs a curl command to POST the installer's hostname, current user, working directory, and a base64-encoded dump of the entire process environment to an attacker-controlled out-of-band collector domain over plain HTTP. The environment dump often contains sensitive secrets such as CI tokens, AWS, GCP, Azure credentials, and npm publish tokens. The package itself exports only basic metadata and mimics an internal Zomato package, suggesting a dependency confusion attack. This malicious behavior triggers automatically on default installation without user opt-in.

Any user or automated system running 'npm install hyperpure' version 1.0.0 will inadvertently disclose sensitive environment variables and credentials to an attacker-controlled server. This can lead to credential compromise, unauthorized access to cloud resources, and further exploitation. The attack requires no user interaction beyond installation and is triggered automatically.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid installing the 'hyperpure' package version 1.0.0 from untrusted sources. Verify package authenticity and consider using package integrity verification or scoped/internal registries to prevent dependency confusion attacks.