The malicious @openzeppelin-5/contracts package (versions 1.0.0 and 1.0.1) contains a package.json that declares preinstall and postinstall scripts executing 'node index.js || true'. The index.js script collects environment variables matching sensitive keywords (e.g., KEY, TOKEN, SECRET, MNEMONIC, WALLET, AWS, GITHUB, NPM) and reads various credential files such as ~/.aws/credentials, ~/.ssh/id_rsa, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.git-credentials, and others. The harvested data is sent to a hardcoded webhook.site endpoint via a detached child process with a randomized delay to evade detection. The malware also performs hostname regex checks to avoid running on known sandbox or scanner hosts, indicating anti-analysis capabilities.

Sensitive environment variables and credential files on the installer’s system can be exfiltrated to an attacker-controlled endpoint, potentially leading to credential compromise and unauthorized access to cloud services, source code repositories, and other sensitive resources. This compromises the security of the affected system and any connected infrastructure relying on these credentials.

No official patch or remediation guidance is available. Users should avoid installing versions 1.0.0 and 1.0.1 of the @openzeppelin-5/contracts package. Verify package authenticity before installation and consider using trusted package sources or integrity verification mechanisms. Monitor for suspicious network activity related to webhook.site endpoints. Remove the malicious package if already installed and rotate any potentially exposed credentials.