Malicious code in net-util-y8 (npm)

The net-util-y8 npm package version 1.1788432509.0 contains no functional code in index.js but embeds a ~42KB POSIX shell script as a base64-encoded blob in the package.json description field. This script acts as a dropper for the XMRig Monero miner, performing preflight checks for curl, wget, openssl, and perl, installing them with root privileges if missing. It fetches miner binaries from gitlab.com and a proxy domain ghfast.top, configures mining to the pool xmr.kryptex.network:8029 with a hardcoded Monero wallet, and includes routines to kill competing miners and mask its process name. The package references related components indicating a staged cryptomining campaign. The use of the description field to smuggle executable payloads is a technique to evade code scanning.

If installed, this package can lead to unauthorized cryptocurrency mining on the affected system, consuming system resources and potentially causing performance degradation. The script runs with elevated privileges to install dependencies and execute the miner, increasing the risk of system compromise. The presence of routines to kill competing miners suggests attempts to maintain exclusive control over system resources. This malicious activity can lead to increased power consumption, hardware wear, and potential security risks associated with unauthorized root-level operations.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing net-util-y8 version 1.1788432509.0 and related packages such as net-util-x7. Security teams should remove this package if found in their environments and monitor for similar malicious packages. Use trusted sources and verify package integrity before installation. Employ supply chain security measures to detect and block malicious npm packages. Since this is a malicious package rather than a software vulnerability, remediation involves removal and prevention rather than patching.