Malicious code in @public-for-cdao/token (npm)

The @public-for-cdao/token package version 99.99.99 contains a postinstall hook that runs a recon.js script during npm installation. This script collects host identity information and enumerates environment variables and files for sensitive credentials such as AWS keys, GitLab tokens, SSH keys, database passwords, private keys, cryptocurrency mnemonics, and tokens for Docker, npm, Slack, and Discord. It also searches common CI/CD runner directories and .env files for secrets. The collected data is exfiltrated via HTTPS POST requests to two attacker-controlled endpoints with TLS verification disabled. The package name and version suggest it is a dependency confusion attack targeting an internal @cdao/token package.

Successful installation of this malicious package results in theft of a broad range of sensitive credentials and secrets from the host environment, potentially leading to unauthorized access to cloud services, source code repositories, deployment environments, databases, and communication platforms. This can facilitate further compromise of the victim's infrastructure and data.

Avoid installing packages from untrusted or unknown public scopes that mimic internal package names. Verify package provenance before installation, especially for packages with suspiciously high version numbers or unknown authorship. Remove the @public-for-cdao/[email protected] package if installed. There is no official patch or fix since this is a malicious package rather than a vulnerability in legitimate software. Use strict package source controls and consider using tools that detect dependency confusion attacks.