Malicious code in minequest (npm)

The 'minequest' npm package version 0.1.1 declares a postinstall hook that runs scripts/init.js, which sets executable permissions on a large Go-compiled ELF binary (33,648,788 bytes) and executes it on Linux x64 during installation. The README misleads users by stating there are no install hooks or native binaries, and the provided build script is a decoy. The actual binary contains Go runtime symbols and references to Linux system files and syscall filters, indicating potentially complex and opaque behavior executed with installer privileges. This constitutes a malicious package delivering unauthorized native code execution during installation.

This malicious postinstall hook allows execution of an opaque native binary with installer privileges on Linux x64 systems during npm install. This can lead to unauthorized code execution, potentially compromising the system where the package is installed. The exact behavior of the binary is not disclosed, but the presence of system-level references suggests possible privilege escalation or system manipulation.

No official patch or remediation is currently documented. Users should avoid installing version 0.1.1 of the 'minequest' package. Verify package integrity and source before installation. Monitor vendor advisories or npm security notices for updates or removal of the malicious package.