The node-fsagent npm package (versions =1.0.0, =1.0.4, =1.0.8, =1.1.1, =1.1.2, =1.1.3, =1.2.0, =1.2.1, =1.2.2) contains a malicious script named archive-sender.js that archives the /root/.codex directory on the host, splits the archive into approximately 200MB chunks, and exfiltrates these chunks by publishing them as sequential versions of the node-fsagent package on the public npm registry. The script reconstructs an npm registry authentication token at runtime by XOR operations on embedded byte arrays, then sets this token in the local npm config to gain publish rights. This mechanism allows covert data exfiltration via the npm registry and also distributes credentials that enable republishing under the attacker's npm account. The package's main entry point is empty, and no lifecycle scripts trigger the malicious code automatically; it only executes if the archive-sender.js script is invoked explicitly. The package advertises no legitimate functionality and is solely designed for malicious purposes.

The malicious package enables covert exfiltration of potentially sensitive data from the host's /root/.codex directory by publishing it in chunks to the public npm registry. Additionally, the embedded authentication token grants publish rights to the attacker's npm account, allowing them to republish the node-fsagent package or other packages owned by that account, potentially facilitating further supply chain attacks or malicious package updates. There is no automatic execution of the malicious code upon installation or require, limiting exploitation to manual invocation of the script.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing or using the node-fsagent package in any of the affected versions. Since the malicious behavior only triggers when the archive-sender.js script is run directly, not on install or require, avoid executing any scripts from this package. Review and revoke any npm registry tokens that may have been compromised due to this package. Monitor npm accounts for unauthorized publishing activity. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.