Malicious code in @public-for-cdao/abi (npm)

The @public-for-cdao/abi package version 99.99.99 includes a postinstall hook that executes a recon.js script during npm install. This script collects environment variables containing CI tokens, GitLab access tokens, AWS credentials, private keys, database passwords, cryptocurrency mnemonics, and other secrets. It also scans common .env file locations for sensitive keys and gathers host system information and directory listings related to GitLab runners. The collected data is saved locally and then sent via HTTPS POST requests to two attacker-controlled endpoints, one of which disables TLS certificate verification. The package name and version are crafted to exploit dependency confusion targeting a private @cdao/abi scope, as indicated by embedded code comments.

Successful installation of this malicious package leads to the theft of a broad range of sensitive credentials and secrets from the host environment, including cloud service keys, CI/CD tokens, private keys, and passwords. This exposure can enable attackers to compromise cloud accounts, source code repositories, deployment pipelines, and other critical infrastructure components. The attack leverages dependency confusion to trick developers into installing the malicious package instead of the legitimate private package.

No official patch or remediation is currently available for this malicious package. The best mitigation is to avoid installing the @public-for-cdao/abi package version 99.99.99 or any suspicious packages from untrusted sources. Organizations should audit their package dependencies for unexpected or unauthorized packages, especially those with unusual version numbers or names mimicking private scopes. Implementing strict package source controls and verifying package provenance can help prevent dependency confusion attacks.