Malicious code in @public-for-cdao/api (npm)

The @public-for-cdao/api package at version 99.99.99 is a high-version public squat of a presumed private @cdao/api package. Its package.json declares a postinstall hook that executes recon.js automatically during npm install. The recon.js script enumerates approximately 30 environment variables related to CI/CD, cloud, wallet, and registry secrets (e.g., AWS_SECRET_ACCESS_KEY, CI_JOB_TOKEN, NPM_TOKEN, GITLAB_ACCESS_TOKEN, DOCKER_PASSWORD, PRIVATE_KEY, MNEMONIC). It also scans common .env file locations for lines containing keywords such as KEY, SECRET, TOKEN, PASS, PRIVATE, or MNEMONIC. The script collects host identifiers and directory listings from typical CI runner paths and exfiltrates all gathered data, including package name and version, to two hardcoded endpoints with TLS verification disabled. The payload self-identifies as a 'CryptoDAO Dependency Confusion Reconnaissance Payload.'

This malicious package can lead to the theft of a broad range of sensitive credentials and secrets from the victim's environment, including cloud service keys, CI/CD tokens, private keys, and cryptocurrency wallet mnemonics. Such credential theft can result in unauthorized access to cloud resources, source code repositories, deployment environments, and financial assets. The exfiltration to attacker-controlled endpoints occurs silently during package installation, increasing the risk of compromise in development and CI environments.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing the @public-for-cdao/api package version 99.99.99 or any similarly suspicious packages from untrusted sources. Organizations should audit their npm dependencies for unexpected or high-version packages that may be dependency confusion squats. Use strict package source verification and consider implementing allowlists for npm packages. Monitor for unexpected postinstall scripts in dependencies. Since this is a malicious package, removal and replacement with trusted packages is recommended.