Malicious code in isite (npm)

The isite npm package, upon initialization, opens a WebSocket connection to a remote server and executes incoming messages via eval, enabling full remote JavaScript execution within the host process. Additionally, it periodically sends the entire framework options object containing sensitive credentials to another remote server over unencrypted HTTP, which can respond with scripts that are also eval'd, providing a second remote code execution vector. The package exfiltrates critical secrets such as database connection URIs, security keys, and admin user data. It also posts caller-supplied text to an external webhook and employs custom obfuscation and fallback mechanisms involving Telegram bot tokens. This behavior effectively grants attackers full control over affected systems.

Systems with the isite package installed are fully compromised, as attackers gain remote code execution capabilities and access to sensitive credentials and user data. This can lead to unauthorized access, data theft, and persistent control over the host environment. The compromise extends beyond the package itself, potentially affecting all secrets stored on the system.

Immediate removal of the isite package from all affected systems is required. All secrets and keys stored on compromised systems must be rotated from a secure, unaffected environment. Due to the full compromise risk, assume the host is fully controlled by attackers and perform comprehensive incident response and system remediation. No official patch or fix is indicated; rely on removal and credential rotation.