Malicious code in nwfp-build-config (npm)

The nwfp-build-config npm package includes a malicious payload in its lib/telemetry.js file that activates immediately when the package is required. It collects the local machine's hostname and username, encrypts this information with a hardcoded 32-byte AES-256-CBC key, and encodes the ciphertext in base32. The encoded data is then split into DNS labels and exfiltrated via DNS A record queries to subdomains of cdn-assets.liderydigital.com, using a covert DNS tunnel designed to bypass HTTP egress controls. The use of silent try/catch blocks hides errors, and the telemetry naming and encryption key are deceptive measures to disguise the identity exfiltration. This behavior is unrelated to the package's declared function of providing build configuration, indicating malicious intent.

Any system with the nwfp-build-config package installed or running is considered fully compromised. The attacker gains access to sensitive identity information and potentially full control of the system. All secrets and keys stored on the affected computer are at risk and should be rotated immediately from a secure, unaffected system. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the compromise.

Remove the nwfp-build-config package immediately from all affected systems. Rotate all secrets, credentials, and keys that were stored or used on the compromised machines, performing this rotation from a clean, trusted environment. Conduct a thorough investigation and remediation of the affected systems, as the presence of this package indicates a full compromise. There is no official patch or fix for this malicious package; mitigation relies on removal and credential rotation.