Malicious code in macos-ci-utils (npm)

The macos-ci-utils package for npm (versions 1.0.0 and 1.0.1) includes obfuscated code that, when the package is first required, decodes a base64 URL pointing to https://api.ingress-hub.com/cdn/assets/update.pkg. It downloads this file to a hidden directory in the user's Library/Application Support folder, sets executable permissions, and runs it detached with ignored stdio. There is no integrity verification of the downloaded binary, and the domain is unrelated to the package publisher. The package's README falsely advertises a passive API and does not disclose this network fetch or binary execution. This results in execution of attacker-controlled code with full user privileges on macOS.

Any macOS system that installs and requires the affected versions of macos-ci-utils will execute arbitrary attacker-controlled code with the privileges of the user running the package. This can lead to full system compromise, data theft, persistence, or further malicious activity. The lack of signature or hash verification increases the risk of undetected compromise.

Users should immediately avoid using macos-ci-utils versions 1.0.0 and 1.0.1. Since no patch or fix is currently available, remove these versions from all systems and dependency trees. Monitor for any unexpected binaries or processes originating from the hidden .node_cache directory. Consider using trusted package sources and verifying package integrity before installation.