Malicious code in @mep-exp/api-tools (npm)

The @mep-exp/api-tools npm package includes a preinstall script and runtime code that collects sensitive system information (os.hostname(), os.userInfo().username, os.platform(), process.cwd(), and a timestamp) and sends it as JSON to a remote webhook URL. The package scope and binary names mimic an internal Westpac 'MEP Experience Platform' toolchain, consistent with a dependency confusion attack. The exfiltrated data includes a marker referencing 'Westpac CT'. The package has no legitimate functionality beyond this beaconing behavior. Installation or use of this package results in silent data exfiltration and potential full system compromise.

Any system with this package installed or running is considered fully compromised. The attacker may have gained extensive access, potentially including secrets and keys stored on the system. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors. Immediate rotation of all secrets and keys from a separate, trusted system is required.

Remove the @mep-exp/api-tools package immediately. Rotate all secrets and keys stored on the affected system from a different, secure machine. Because the package may have granted full control to an attacker, assume the system is compromised and consider rebuilding or isolating it. No official patch or fix is available; remediation relies on removal and secret rotation.