Malicious code in nordpass (npm)

The malicious 'nordpass' npm package (versions 1.0.0, 1.0.2, and 1.0.4) impersonates the NordPass password manager and presents itself as an authentication module. Its postinstall script compiles native code and runs an obfuscated ~100 KB JavaScript file that reads /etc/passwd to derive XOR keys combined with hardcoded constants. It base64-decodes and XOR-decrypts an embedded payload, then executes it via eval(). The code includes anti-debugging checks such as NODE_OPTIONS '--inspect' detection, timing gates, and environment variable kill switches. A native binary is staged during installation. The package also communicates with a domain associated with malicious activity, enabling attacker-controlled code execution on the installer's machine at install time.

Installation of this package results in execution of attacker-controlled code on the host machine with the privileges of the installing user. The malicious code reads sensitive system files, evades analysis, and stages a native binary, potentially enabling further compromise. Communication with a malicious domain indicates possible data exfiltration or command and control. This poses a significant security risk to users who install this package.

No official patch or remediation is currently documented. Users should avoid installing the 'nordpass' npm package versions 1.0.0, 1.0.2, and 1.0.4. Verify package authenticity before installation and prefer official sources. Monitor for updates from the package maintainer or npm security advisories for remediation guidance. Consider removing the package and scanning affected systems for compromise if installed.