Malicious code in qr-code-styling-temp (npm)

The 'qr-code-styling-temp' npm package contains malicious code that triggers during the install lifecycle script and on every require call. It loads system modules dynamically to evade static detection and collects sensitive system identifiers (username, hostname, current working directory). This information is encoded into a subdomain and sent via DNS resolution requests to a command-and-control domain 'oob.sl4x0.xyz', enabling out-of-band data exfiltration. The package is a typosquat of the legitimate 'qr-code-styling' library, with a different API and attacker-controlled infrastructure. The presence of this package indicates a full system compromise risk.

Any system with this package installed or running is at high risk of compromise due to active data exfiltration of sensitive system information. The attacker gains knowledge of the user identity and system environment, which can facilitate further attacks or unauthorized access. The compromise is severe enough that all secrets and keys on the affected system should be considered exposed and rotated immediately. Removing the package alone may not eliminate all malicious artifacts or backdoors.

Remove the 'qr-code-styling-temp' package immediately from all affected systems. Consider all systems with this package installed as fully compromised. Rotate all secrets, credentials, and keys from a secure, unaffected system. Conduct a full security audit and forensic analysis to identify and remediate any persistent malicious presence. There is no official patch or fix for this malicious package; prevention involves avoiding installation of typosquatting packages and verifying package authenticity before use.