The @remitee-money-transfer/rmt-base npm package is malicious. Its preinstall lifecycle script reads critical system files including /etc/passwd and the root SSH private key, retrieves the host's public IP address, and sends this data to a remote server controlled by the attacker. The package is published under a scope impersonating Remitee and uses inflated version numbers consistent with dependency confusion attacks targeting private internal packages. The declared main entry point does not exist, indicating no legitimate functionality. The attacker’s handle and exfiltration endpoint are linked, and the exfiltration uses curl with TLS verification disabled, confirming malicious intent.

Sensitive system information and private SSH keys can be stolen during package installation, potentially leading to unauthorized access and further compromise of affected systems. The malicious package can be introduced via dependency confusion, affecting internal development environments relying on private packages under the same namespace.

No official patch or fix is currently available. Users should immediately audit their dependencies for the presence of @remitee-money-transfer/rmt-base versions 99.99.99, 99.99.100, 99.99.102, and 99.99.104 and remove or block these packages. Avoid installing packages from untrusted or impersonated namespaces. Implement strict controls on package sources and consider using package allowlists or private registries to prevent dependency confusion attacks.