The 'permit2' npm package is a name-squatting malicious package that pretends to be a smart contract development toolkit related to Uniswap's Permit2 system. It contains only a package.json and an index.js payload that runs automatically during both preinstall and postinstall phases of npm installation. The payload collects environment variables matching a broad pattern of secret-related keywords and reads the full contents (up to 4000 bytes each) of numerous credential and key files, including AWS credentials, SSH private keys, Kubernetes config, Docker config, Git credentials, cloud provider credentials (GCP, Solana, NEAR, Sui), Foundry keystores, and local .env files. It also collects system metadata such as hostname, username, current working directory, and platform. The collected data is sent via HTTPS POST to a hardcoded attacker webhook endpoint. The payload delays exfiltration in a detached child process to evade detection and avoids running in sandbox or mirror environments. The package provides no real functionality and is purely designed for credential theft.

Any system that installed the 'permit2' package version 1.0.0 or 1.0.1 is at risk of credential compromise. Sensitive secrets including SSH keys, cloud provider credentials, wallet keystores, and environment secrets may have been exfiltrated to an attacker-controlled server. This can lead to unauthorized access to cloud resources, source code repositories, cryptographic wallets, and other sensitive infrastructure. Immediate credential rotation is required for all exposed secrets.

No official patch or fix is available since this is a malicious package impersonation rather than a software vulnerability. The recommended mitigation is to identify and remove the 'permit2' package versions 1.0.0 and 1.0.1 from all environments. Rotate all credentials and secrets that may have been exposed, including SSH keys, cloud credentials, wallet keystores, and environment variables. Avoid installing unscoped packages that impersonate well-known scoped packages. Use package integrity verification and trusted registries to prevent installation of malicious packages.