Malicious code in passkeys-react (npm)

The passkeys-react npm package version 1.0.1 declares a preinstall hook in its package.json that runs a script (index.js) on installation. This script performs host reconnaissance by gathering sensitive system information such as hostname, username, home directory, DNS servers, current working directory, and the contents of /etc/passwd and /etc/hosts. It then exfiltrates this data over HTTPS to a hardcoded subdomain associated with an out-of-band interaction service (OAST). This behavior is inconsistent with the package's stated purpose as a passkeys React helper, indicating malicious activity. The package compromises the host system upon installation and may allow an attacker full control.

Any computer with passkeys-react version 1.0.1 installed is considered fully compromised. The attacker may have obtained sensitive system information and potentially full control over the system. All secrets and keys stored on the compromised computer should be considered exposed and must be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee eradication of all malicious software or backdoors introduced by the compromise.

Remove the passkeys-react package version 1.0.1 immediately from affected systems. Rotate all secrets, keys, and credentials that were stored on the compromised machine using a separate, trusted device. Because the system may be fully compromised, consider rebuilding or restoring the system from a known good backup. There is no official patch or fix available; the package itself is malicious. Avoid installing this package and monitor for any signs of compromise related to it.