Malicious code in real-router-telemetry (npm)

The real-router-telemetry npm package ships with an obfuscated telemetry.js module that reads host identity details (hostname, username, current working directory, platform, architecture, memory, CPU info), executes system commands ('cat /etc/os-release' and 'ps aux'), and reads the .env file from the current working directory. It then sends the collected data as JSON to an anonymous webhook URL unrelated to the package publisher. The package.json declares a postinstall hook executing index.js, which in the shipped versions is a stub not requiring telemetry.js, indicating the malicious payload is staged but not yet activated at install time. The combination of obfuscation, secret exfiltration, and version metadata mismatch strongly suggests a malicious package.

Sensitive system and environment information, including potentially secret credentials stored in .env files, can be exfiltrated to an attacker-controlled endpoint. This compromises confidentiality of host and developer environment data, potentially leading to further compromise if credentials are reused or provide access to critical systems.

No official patch or remediation is documented for this package. Users should avoid installing or using the real-router-telemetry package versions 1.0.1 and 1.0.4. Remove any existing installations and audit systems for presence of this package. Monitor for suspicious network connections to unknown endpoints. Since the malicious code is staged but not fully wired in these versions, vigilance is required for future versions or variants.