Malicious code in rn-push-provisioning (npm)

The 'rn-push-provisioning' npm package declares a preinstall lifecycle script ('node beacon.js || true') that executes automatically during 'npm install'. The script collects system identifiers including hostname, username, platform, and architecture, then transmits this data via HTTPS GET to a hardcoded third-party domain unrelated to the legitimate publisher. The package is published at versions 99.0.0 and 99.0.1 and appears to be a dependency-confusion lure targeting internal package resolution. The exfiltration of installer host and user information at install time constitutes a malicious package behavior that compromises the host system.

Any computer with this package installed or running should be considered fully compromised. The attacker may have gained control over the system, and all secrets and keys stored on the computer are at risk. Immediate rotation of all credentials from a different, uncompromised system is necessary. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the package.

Remove the 'rn-push-provisioning' package immediately from affected systems. Rotate all secrets, credentials, and keys stored on the compromised system from a separate, trusted environment. Conduct a thorough investigation for additional malicious software or persistence mechanisms installed as a result of this compromise. There is no official patch or fix; remediation relies on removal and credential rotation.