Malicious code in raectjs (npm)

The 'raectjs' npm package version 1.0.0 includes a postinstall.js script that performs two malicious actions: it sends a JSON snapshot of the platform to a hardcoded IP address (http://193.70.34.101:20099/vote) using an obfuscated hostname, and it XOR-decodes an embedded payload URL to download a Windows executable from a GitHub releases page under an attacker-controlled account. This executable is saved to the temporary directory and executed silently. On WSL or virtualized Linux environments, the script decodes and runs a PowerShell bridge to execute the payload on the Windows host. The package has no legitimate functionality and lacks any native source code consistent with a real addon. There is no integrity verification of the downloaded binary.

Systems that install this package version risk executing attacker-controlled code, potentially leading to system compromise. The malicious postinstall script exfiltrates system information and silently runs a downloaded executable without validation, which could facilitate further malicious activities. The lack of signature or hash verification increases the risk of arbitrary code execution.

No official patch or remediation is currently documented. Users should avoid installing the 'raectjs' package version 1.0.0. Remove any installations of this package and scan affected systems for the presence of the downloaded payload. Monitor for network connections to the hardcoded IP address and GitHub URLs mentioned. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.