Malicious code in pay-methods-kmf (npm)

The pay-methods-kmf npm package (versions 100.100.100, 100.100.101, and 100.100.102) is a malicious package that masquerades as a frontend utility but contains a prebuilt Linux x64 native addon. During installation, the package executes a postinstall script that performs two concurrent exfiltration channels: a DNS beacon that encodes the installer's hostname and package name to an OAST collector domain, and an HTTP POST request to a hardcoded IPv4 address (64.181.165.115) leaking the installer's hostname, username, package name, and npm registry URL. The native addon's symbol set indicates network communication and process control unrelated to frontend utilities. The package ships no source code for the binary, and the exfiltration infrastructure is attacker-controlled. The versioning and registry URL exfiltration suggest the package is used for internal registry reconnaissance via dependency confusion.

Installation of the affected pay-methods-kmf package versions results in leakage of sensitive environment information including the installer's hostname, username, package name, and npm registry URL. This can expose internal or private registry hosts and potentially aid attackers in further reconnaissance or targeted attacks. The malicious code runs silently during installation, increasing the risk of unnoticed data exfiltration.

No official patch or remediation is currently documented. Users should avoid installing the affected versions (=100.100.100, =100.100.101, =100.100.102) of the pay-methods-kmf package. Validate package sources and consider using trusted registries and package integrity verification. Monitor for suspicious network activity related to npm package installations. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.