Malicious code in ksp-client-registry (npm)

The ksp-client-registry npm package at versions 100.100.100 and 100.100.101 includes a prebuilt native addon (addon.node) loaded by the main module. Upon loading, the addon reads environment variables HOSTNAME, npm_package_name, and npm_config_registry, then opens a raw TCP socket to IP 64.181.165.115. It sends an HTTP POST request containing these values, effectively beaconing host and package information to an external server. The package's postinstall script runs 'node postinstall.js', leaving an install-time footprint. The addon exposes no legitimate N-API functions beyond module registration. The package's high version number and generic name suggest it is a dependency confusion probe designed to be resolved instead of an internal package, leaking sensitive environment details to the operator.

This malicious package can exfiltrate sensitive environment information including the host's hostname, the internal package name, and the configured npm registry URL to an attacker-controlled server. This can lead to exposure of internal infrastructure details and potentially facilitate further targeted attacks. There is no indication of remote code execution or direct system compromise beyond information leakage.

No official patch or remediation is currently documented. Users should avoid installing or requiring the ksp-client-registry package at versions 100.100.100 and 100.100.101. Verify internal package names and registry configurations to prevent dependency confusion attacks. Monitor for unexpected network connections to IP 64.181.165.115. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.