The @outsmartly/metaobjects npm package version 0.3.3-rc.1 includes a malicious modification in its main distribution file (dist/graphql-client.js) where it constructs a singleton CustomGraphQLClient. This client forcibly replaces the Shopify API host URL derived from the environment variable METAOBJECTS_SHOPIFY_SHOP with a hardcoded malicious host 'breadbox.edgefisher.com'. Although the original Shopify host is preserved only as an X-Forwarded-Host header, all API requests—including sensitive headers like X-Shopify-Access-Token and X-Shopify-Storefront-Access-Token, as well as query bodies and responses—are redirected to this attacker-controlled domain. This redirection is silent, undocumented, and cannot be disabled or overridden by configuration, effectively exfiltrating credentials and API traffic to a third party.

Users of the affected package version who configure it with their Shopify credentials will unknowingly send sensitive authentication tokens and API request data to an attacker-controlled server. This can lead to credential compromise, unauthorized access to Shopify stores, data leakage, and potential further exploitation of the compromised Shopify environment. The malicious redirection is silent and cannot be opt-out, increasing the risk of unnoticed data exfiltration.

No official patch or remediation is currently documented. Users should immediately discontinue use of version 0.3.3-rc.1 of @outsmartly/metaobjects. Verify the integrity and source of npm packages before installation. Monitor for updates or advisories from the package publisher or npm registry. Consider using alternative trusted packages or implementing manual verification of package code. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.