Malicious code in mutex-thread (npm)

The 'mutex-thread' npm package version 1.3.0 includes a malicious branch in its runExclusive function that triggers when the callback meta.jobId equals 'cross-chain-transfer'. This branch spawns a detached Node.js process running an obfuscated dropper script (withLoad.min.js) that interacts with a Sepolia Ethereum smart contract to retrieve encrypted payloads. The dropper decrypts these payloads using a derived shared secret, writes them to disk with executable permissions, and executes them. Before executing commands, it collects detailed host reconnaissance data (OS platform, release, architecture, hostname, CPU info, memory, uptime) and sends this information to hardcoded Slack and Telegram bots. Another script polls Slack's conversation history to receive encrypted commands, which it decrypts and executes dynamically. The malware supports self-deletion triggered by a specific sentinel command. The code uses string rotation and base64 encoding to obfuscate critical strings such as C2 hosts, bot tokens, channel IDs, and the Ethereum contract address.

This malicious package enables remote attackers to execute arbitrary code on affected systems by delivering encrypted payloads through a blockchain-based command and control mechanism. It compromises host confidentiality by collecting and exfiltrating system information to attacker-controlled Slack and Telegram bots. The malware can update itself dynamically and remove traces upon receiving specific commands, complicating detection and remediation.

No official patch or remediation guidance is provided in the available data. Users should immediately remove version 1.3.0 of the 'mutex-thread' package from their environments and avoid using this package until a trusted, clean version is available. Monitor for any unusual Node.js child processes or network connections to Slack or Telegram APIs. Check vendor advisories or trusted security sources for updates on remediation or patched versions.