Malicious code in octopus-action (npm)

The octopus-action npm package version 1.0.1 includes a preinstall lifecycle script (node index.js) that runs automatically on npm install. This script gathers the installer's hostname, OS username, home directory, configured DNS servers, package metadata, and contents of /etc/passwd and /etc/hosts. It then sends this collected data via HTTPS POST to an external Burp Collaborator out-of-band server controlled by a third party. This behavior results in exfiltration of sensitive system identifiers and files. According to the GHSA advisory, any system with this package installed or running should be considered fully compromised, necessitating immediate rotation of all secrets and keys from a different machine. Removal of the package alone may not remove all malicious software introduced.

Installation of octopus-action version 1.0.1 leads to exfiltration of sensitive system information to an attacker-controlled server. The system is considered fully compromised, potentially exposing all stored secrets and keys. Attackers may have persistent access beyond removal of the package, increasing the risk of further malicious activity.

Remove the octopus-action package version 1.0.1 immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted machine. Because full system compromise is likely, consider rebuilding the system or performing a thorough forensic investigation. No official patch or fix is available; avoidance and removal are the primary mitigations.