Malicious code in portal-backend (npm)

This threat involves a malicious npm package 'portal-backend' at version 999.0.0. During 'npm install', the package's preinstall hook executes 'postinstall.js', which enumerates environment variables filtering keys with credential-related keywords (e.g., key, secret, token, pass, ssh, deploy, auth, api). It collects these values along with system details such as hostname, username, current working directory, and npm registry configuration. The collected data is sent via HTTPS POST to a suspicious IP address (185.130.46.35:8443) unrelated to any legitimate publisher domain. The package's code is minimal and designed to outrank private registry versions to induce dependency confusion, causing sensitive CI and developer environment secrets to be exfiltrated upon installation.

Installing this malicious package results in immediate exfiltration of sensitive environment variables including CI secrets, deploy tokens, SSH credentials, and host identity information to an attacker-controlled server. This compromises the confidentiality of critical credentials and can lead to further unauthorized access or compromise of development and deployment infrastructure.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing the 'portal-backend' package version 999.0.0 from public npm registries. Organizations should audit their dependency sources to prevent dependency confusion attacks by properly configuring private registries and using package allowlists or integrity verification. Monitor for unexpected packages with suspicious versioning and verify package provenance before installation.