Malicious code in ksp-app (npm)

The ksp-app package at version 100.100.100 is a malicious npm package designed for dependency confusion attacks. It contains an opaque prebuilt ELF native addon for Linux x64 that is loaded during the postinstall phase via a script declared in package.json. This native addon reads environment variables related to the host and npm configuration and sends them via an HTTP POST request to a hardcoded IP address (64.181.165.115). The package has no source code or build tooling, and its JavaScript stub exports an empty object, indicating that all malicious behavior is embedded in the native binary. This behavior is consistent with exfiltration of internal environment details and npm registry URLs to an attacker-controlled endpoint.

The malicious package can leak sensitive environment information such as the hostname, package name, and npm registry URL configured in the victim's environment. This can lead to exposure of internal infrastructure details and potentially facilitate further targeted attacks. The package does not appear to execute arbitrary code beyond data exfiltration, but the disclosure of internal registry URLs can aid attackers in reconnaissance and supply chain compromise.

No official patch or remediation is indicated for this package. Users should avoid installing the ksp-app package at version 100.100.100 from untrusted sources. Review and restrict npm package sources to trusted registries to prevent dependency confusion attacks. Monitor for and remove any installations of this package. Since this is a malicious package rather than a vulnerability in legitimate software, remediation involves removing the package and preventing its installation.