Malicious code in remove-bg-serverless-azure (npm)

The remove-bg-serverless-azure npm package version 1.0.1 declares a preinstall script that runs index.js during npm install. This script collects system identifiers and sensitive files such as /etc/passwd and /etc/hosts, then exfiltrates them via HTTPS POST to a hardcoded attacker-controlled domain (7iqn7pls4ly6w8valba0xcxygpmha7yw.oastify.com). The presence of this malicious code means that any system installing this package is at risk of full compromise, with attacker access to secrets and keys stored on the system.

Installing this package results in the exfiltration of sensitive system information to an external attacker. The system is considered fully compromised, potentially exposing all stored secrets and keys. Even after removal of the package, there is no guarantee that all malicious software or backdoors have been eradicated, posing ongoing risk to the affected system.

Immediately remove the remove-bg-serverless-azure package version 1.0.1 from affected systems. Rotate all secrets and keys stored on the compromised system from a separate, trusted machine. Conduct a thorough security assessment and remediation to detect and remove any persistent malicious software or backdoors that may have been installed. Avoid installing this package or any untrusted npm packages without verification.