Malicious code in jobber-app-template-react (npm)

The jobber-app-template-react npm package version 1.0.1 includes a preinstall script that runs index.js upon npm install. This script gathers host reconnaissance data including hostname, username, home directory, DNS servers, and directory paths, and reads sensitive system files (/etc/passwd and /etc/hosts). It then sends this information as a JSON payload over HTTPS to a hardcoded Burp Collaborator subdomain (5tzh3l2e1cetr1chf6osh4tg57b0zqnf.oastify.com). This malicious behavior is unrelated to the package's intended purpose as a React app template and is characteristic of a dependency confusion attack designed to exfiltrate sensitive data.

Systems that install or run this package are fully compromised due to the execution of malicious code during installation. Sensitive host information and system files are exfiltrated to an attacker-controlled domain. This can lead to unauthorized access, credential theft, and further compromise. All secrets and keys stored on affected machines should be considered exposed and must be rotated immediately from a clean environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is available. Immediate removal of the jobber-app-template-react package version 1.0.1 is recommended. All secrets and credentials on affected systems should be rotated from a different, uncompromised machine. Consider rebuilding or restoring affected systems from known good backups to ensure complete remediation. Monitor for any suspicious activity related to this package installation.