Malicious code in line-through (npm)

The 'line-through' npm package version 1.0.0 includes a preinstall hook that executes a script named vishu.js. This script collects sensitive environment information such as the public IP (via api.ipify.org), OS hostname, and GitHub Actions/CI environment variables (including CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID). It then sends this information as query parameters in an HTTPS GET request to a hardcoded external collector URL at webhook.site. Additionally, it performs a DNS lookup using the hostname encoded as a subdomain of a placeholder out-of-band collaborator domain. This data exfiltration occurs automatically during the npm install process without requiring user interaction.

The malicious code leaks potentially sensitive environment information including public IP, hostname, and CI environment variables to an external attacker-controlled server. This can lead to privacy violations and may aid attackers in further reconnaissance or targeted attacks. There is no indication of code execution beyond data exfiltration, and no known exploits in the wild have been reported.

No official patch or remediation is currently documented. Users should avoid installing version 1.0.0 of the 'line-through' package. Review and audit dependencies before installation, especially those with preinstall hooks. Monitor for updates or advisories from the package maintainers or npm registry for official fixes.