The 'lab-helper' npm package versions 0.0.2 and 0.0.3 include a postinstall lifecycle script that runs 'sec_check.js'. This script enumerates network interfaces and proceeds only if an IPv4 address matches the 18.175. subnet, effectively gating execution to targeted environments. Upon passing this gate, the script reads 'myfile.txt' from the installer's current working directory and sends its contents via an HTTP POST request to a hardcoded IP address (18.175.63.47) on port 8080. This exfiltration mechanism, combined with the targeted network check and automatic execution during package installation, characterizes a supply-chain attack designed to stealthily compromise specific hosts, likely within AWS or lab subnets.

Systems that install the affected versions of the 'lab-helper' package and meet the network targeting criteria are at high risk of data exfiltration. The malicious script can leak sensitive files from the installer's environment to an external attacker-controlled server. The compromise is severe enough that the entire system should be considered fully compromised, necessitating immediate rotation of all secrets and keys. Removal of the package alone may not eliminate all malicious components, indicating potential persistence mechanisms.

No official patch or fix is currently documented. Immediate removal of the 'lab-helper' package versions 0.0.2 and 0.0.3 is recommended. Due to the high likelihood of full system compromise, all secrets and credentials stored on the affected system should be rotated from a separate, trusted environment. Investigate the system for additional malicious artifacts or persistence mechanisms. Monitor for any network traffic to the IP address 18.175.63.47 and block it if possible. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.