Malicious code in quartz-core (npm)

The quartz-core npm package at version 99.1.9 includes a preinstall hook that runs index.js, which gathers sensitive environment details such as the OS username, hostname, and current working directory. It then performs a DNS A-record query to a subdomain of an attacker-controlled domain, embedding these details in the query. The package itself contains no other code or dependencies, indicating its purpose is reconnaissance to identify internal build environments vulnerable to dependency confusion attacks. This malicious behavior compromises the security of any system where the package is installed.

Any system with quartz-core version 99.1.9 installed is considered fully compromised. The attacker gains information about the environment and potentially control over the system. All secrets and keys stored on the compromised system should be rotated immediately from a separate, trusted machine. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced during installation.

No official patch or fix is available. Immediate removal of the quartz-core package version 99.1.9 is recommended. All credentials and secrets stored on the affected system must be rotated from a different, secure environment. Treat the compromised system as fully controlled by an attacker and consider rebuilding or isolating it to ensure complete remediation.