Malicious code in @public-for-cdao/config (npm)

The @public-for-cdao/config package at version 99.99.99 is malicious. It executes a postinstall hook running recon.js, which collects host identifiers and sensitive credentials including CI tokens, GitLab access tokens, SSH keys, AWS credentials, database passwords, private keys, cryptocurrency mnemonics, Docker and npm credentials, and Slack/Discord tokens from environment variables and common .env file locations. The collected information is exfiltrated via HTTP POST to two attacker-controlled endpoints, one on webhook.site and another on Pipedream, with TLS verification disabled. This package is part of a dependency-confusion attack targeting internal package scopes.

Successful installation of this package results in the theft of extensive sensitive credentials and secrets from the host environment, potentially leading to unauthorized access to cloud services, source code repositories, deployment environments, and other critical infrastructure. The attacker gains access to environment variables and configuration files that may compromise the confidentiality and integrity of affected systems and data.

There is no official patch or fix available for this malicious package. Users should avoid installing the @public-for-cdao/config package version 99.99.99 or any packages from the @public-for-cdao scope unless verified as legitimate. Implement strict package source verification and use scoped package allowlists to prevent dependency confusion attacks. Audit your environment for any signs of credential exposure if this package was installed.