Malicious code in @public-for-cdao/common (npm)

The @public-for-cdao/common package version 99.99.99 includes a postinstall hook that runs a recon.js script during npm installation. This script harvests environment variables containing credentials such as AWS keys, GitLab tokens, SSH keys, database passwords, private keys, cryptocurrency mnemonics, and tokens for Docker, npm, Slack, and Discord. It also scans common .env file locations for secret-like strings. The collected data, along with host identifiers, is exfiltrated via HTTPS POST requests to two hardcoded external endpoints, with TLS certificate verification disabled. The package is part of a dependency-confusion attack targeting CI/CD pipelines that resolve internal @cdao scoped packages from the public npm registry instead of private sources.

Successful installation of this malicious package leads to theft of a broad range of sensitive credentials and secrets from the host environment and CI/CD systems. This can result in unauthorized access to cloud services, source code repositories, deployment environments, databases, and communication platforms. The attack compromises confidentiality and potentially integrity of affected systems and data.

No official patch or remediation is currently documented for this malicious package. The best mitigation is to avoid installing the @public-for-cdao/common package version 99.99.99 from public npm registries. Organizations should audit their dependency resolution configurations to prevent dependency confusion attacks by ensuring internal scoped packages are resolved from trusted private registries only. Monitoring for unexpected postinstall scripts and verifying package provenance before installation is recommended.