Malicious code in myebaynode (npm)

The 'myebaynode' npm package version 99.0.0 includes a preinstall script that executes a curl command to fetch a JavaScript file from 'https://poc.amanrawat.com/hehe.js' and runs it immediately. This fetched payload is not pinned by hash or signature, enabling the remote host owner to change the code at any time. The execution occurs with the full filesystem and network access of the user installing the package. The package metadata suggests brand impersonation to lure developers searching for an eBay-related Node.js package.

Installation of this package results in arbitrary code execution on the installer's system with their user privileges. This can lead to compromise of the local environment, data theft, or further malicious activity depending on the payload delivered by the remote server. Because the payload is mutable, the risk is ongoing and can change over time.

No official patch or fix is available. Users should avoid installing the 'myebaynode' package version 99.0.0. Verify package authenticity before installation, prefer official packages from trusted sources, and audit lifecycle scripts in dependencies. Consider using package integrity verification tools and lockfiles to prevent untrusted code execution during installation.