Malicious code in rs-lookout-sandbox-poc (npm)

The rs-lookout-sandbox-poc npm package version 1.0.1 includes malicious behavior triggered immediately upon module load. The package reads the local operating system username via os.userInfo().username and sends this information via an HTTPS GET request to a hardcoded external collector endpoint at https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/. Concurrently, it performs AWS Instance Metadata Service (IMDS) reconnaissance by issuing a PUT request to obtain an IMDSv2 session token from 169.254.169.254/latest/api/token and then a GET request to enumerate IAM security credentials from /latest/meta-data/iam/security-credentials/. These actions occur automatically without user interaction, indicating the package is designed to exfiltrate sensitive environment information stealthily.

The malicious code exposes the local system username to an anonymous external endpoint, potentially compromising user privacy. More critically, the AWS IMDS reconnaissance attempts to retrieve IAM role credentials, which could lead to unauthorized access to AWS resources if exploited further. This behavior risks credential leakage and unauthorized cloud resource access on hosts running this package.

No official patch or remediation is currently documented for this package version. Users should avoid installing or using rs-lookout-sandbox-poc version 1.0.1. Remove the package from any environments where it is present. Monitor for unexpected network connections to unknown external endpoints, especially those resembling the described webhook URL. Consider restricting outbound network access for build or runtime environments to prevent data exfiltration. Check vendor advisories or npm security advisories for updates or removal notices.