The '@openzeppelin-4/contracts' npm package is a malicious package impersonating the legitimate '@openzeppelin/contracts' scope. Instead of providing Solidity contracts, it includes an index.js script executed during lifecycle events that enumerates environment variables for credential-like keys and reads various secret files such as AWS credentials, SSH keys, Kubernetes configs, Docker configs, npm and git credentials, cloud application credentials, blockchain keystores, and project environment files. The collected data is exfiltrated via an HTTP POST request to a remote webhook URL. The script uses a randomized delay between 60 and 240 seconds before execution and avoids running if it detects sandbox or scanning environments by checking hostnames, usernames, and environment markers, thereby evading install-time analysis.

This malicious package can lead to the theft of a wide range of sensitive credentials and secret files from the victim's environment, including cloud service keys, SSH private keys, blockchain wallets, and other configuration files. This exposure can result in unauthorized access to cloud accounts, source code repositories, blockchain assets, and other critical infrastructure. The evasion techniques reduce the likelihood of detection during automated scans.

Users should avoid installing packages from untrusted or suspicious sources, especially those impersonating well-known packages. Verify package names and scopes carefully before installation. Remove any installations of '@openzeppelin-4/contracts' versions 1.0.0 and 1.0.1. Since no official patch or remediation is provided, manual removal and credential rotation are recommended. Monitor for any unauthorized access using compromised credentials and consider revoking and regenerating secrets that may have been exposed.