Malicious code in order-package-saas (npm)

The 'order-package-saas' npm package at versions 999.0.0 and 999.0.1 contains a postinstall script that harvests a wide range of installer-owned secrets from the user's home directory and environment variables. The collected data includes configuration files for npm, yarn, git, SSH keys, cloud provider credentials (AWS, GCP, Azure), Kubernetes, Docker, Terraform, GitHub CLI, Heroku, Vercel, Netlify, Supabase, Firebase, VSCode settings, and various package manager credentials. It also collects system metadata such as hostname, username, platform, architecture, current working directory, and Node.js version. This data is base64-encoded and sent to a Telegram bot API endpoint and a remote HTTP server. The malicious code avoids execution in test, continuous integration, and containerized environments by checking environment variables and the presence of /.dockerenv, and introduces a randomized delay to evade sandbox detection. The package name and version suggest it is a dependency confusion attack vector targeting internal packages. The OpenSSF Package Analysis project and Amazon Inspector have flagged this package as malicious.

If installed, this package can exfiltrate a wide range of sensitive credentials and secrets from the user's environment, potentially leading to unauthorized access to cloud accounts, version control systems, deployment platforms, and other critical infrastructure. The attacker gains access to private keys, tokens, and passwords that can be used for further compromise. The evasion techniques reduce the likelihood of detection in automated testing or CI pipelines, increasing the risk of unnoticed credential theft.

Do not install or use the 'order-package-saas' package versions 999.0.0 and 999.0.1. Remove any installations of this package immediately and rotate any potentially compromised credentials and secrets. Since no official patch or fix is indicated, avoid using this package entirely. Employ strict package source verification and dependency management practices to prevent dependency confusion attacks. Monitor for any suspicious network traffic to the indicated endpoints and investigate any potential exposure.