Malicious code in @open-banking/cabinet-providers (npm)

The package @open-banking/[email protected] is a dependency-confusion bait package with an anomalously high version number under a generic scope. Its package.json specifies a postinstall script that sends the contents of /etc/passwd to a Burp Collaborator (OAST) endpoint using curl. Additionally, a bundled script hex-encodes the hostname, home directory, and username, splitting the data into chunks sent as DNS-style subdomains to another OAST endpoint. Both data exfiltration actions occur automatically during npm install without user consent. This behavior effectively compromises the host by leaking sensitive system information to an external attacker.

Any system that installs this package is at high risk of compromise due to automatic exfiltration of sensitive system files and host identity information. The presence of this package indicates a full compromise, and all secrets and keys on the affected system should be considered exposed and rotated immediately. Removing the package alone may not eliminate all malicious artifacts or backdoors introduced during installation.

There is no official patch or fix available for this malicious package. The recommended mitigation is to immediately remove the package from all affected systems. All secrets, credentials, and keys stored on compromised systems should be rotated from a secure, unaffected environment. Due to the severity of the compromise, affected systems should be thoroughly audited and potentially rebuilt to ensure no persistent malicious code remains.