Malicious code in prism-registry (npm)

The prism-registry npm package version 1.0.1 declares a preinstall script that runs 'node index.js' automatically on npm install. This script collects various host identifiers including hostname, user info, home directory, DNS servers, directory paths, and package.json contents. It also reads sensitive local files such as /etc/passwd and /etc/hosts. The collected data is sent via HTTPS POST to a hardcoded Burp Collaborator subdomain (zjmjb1b5mnwtdcmzrsq6uj4bj2ptdj18.oastify.com). The package has no legitimate functionality and acts solely as a beacon to exfiltrate sensitive information. Due to this behavior, any system with this package installed is considered fully compromised.

Systems with prism-registry version 1.0.1 installed are fully compromised as the package exfiltrates sensitive host information and local files to an attacker-controlled server. This exposure can lead to unauthorized access, credential theft, and further compromise. Secrets and keys stored on the affected system should be rotated immediately from a secure, unaffected environment. Removing the package alone may not fully remediate the compromise due to potential persistence mechanisms.

Remove the prism-registry package version 1.0.1 immediately from affected systems. Rotate all secrets, credentials, and keys that were stored on the compromised system from a different, secure computer. Because the package grants full control to an external entity, assume the system is compromised beyond just the package and perform a thorough incident response and system rebuild if necessary. No official patch or fix is available; the package itself is malicious and should not be used.