Malicious code in @public-for-cdao/types (npm)

The @public-for-cdao/types package is involved in a targeted dependency-confusion attack. Its package.json includes a postinstall hook that runs recon.js automatically on npm install. The recon.js script collects system information, environment variables related to CI/CD, cloud credentials, private keys, cryptocurrency mnemonics, and secrets found in .env files from common directories. It then sends this data to fixed webhook.site and Pipedream endpoints, with TLS verification disabled on one endpoint. The package exports a stub module and uses a high version number (99.99.99) to impersonate an internal package '@cdao/types'. This behavior enables credential theft during package installation.

Successful installation of this malicious package results in the theft of a broad range of sensitive credentials including CI tokens, GitLab access tokens, SSH keys, AWS credentials, database passwords, private keys, cryptocurrency seed phrases, and tokens for Docker, npm, Slack, and Discord. This can lead to unauthorized access to cloud resources, source code repositories, deployment environments, and other critical infrastructure components. The attack exploits dependency confusion to trick developers or automated systems into installing the malicious package instead of the intended internal package.

No official patch or remediation is indicated for this malicious package itself. The best mitigation is to avoid installing the @public-for-cdao/types package version 99.99.99 or any packages from the @public-for-cdao scope that exhibit this behavior. Organizations should audit their dependency sources to prevent dependency confusion attacks, restrict package installation to trusted registries, and monitor for unexpected postinstall scripts. Since this is a malicious package published to npm, removing or blocking the package from internal use is recommended.