Malicious code in @s4yhiitestpoc/r2-https (npm)

The npm package @s4yhiitestpoc/r2-https version 1.0.0 includes a postinstall.js script that automatically executes upon installation. This script collects extensive fingerprinting data from the host environment, including system and network details, and sends this information as JSON to a hardcoded third-party domain (https://collector.oob.s4yhii.com/_npm-poc/beacon). Additionally, it performs a DNS lookup to a subdomain of oob.s4yhii.com to confirm execution via DNS exfiltration. The collected data includes npm_config_registry, potentially exposing internal or private npm registry URLs. Despite being described as a proof-of-concept or coordinated disclosure, the behavior constitutes unauthorized data exfiltration and privacy violation.

The malicious postinstall script leaks sensitive host environment information and npm configuration details to an external attacker-controlled server without user consent. This can lead to exposure of internal infrastructure details, such as private npm registry URLs, and potentially aid further targeted attacks or reconnaissance. The automatic execution during installation increases the risk of widespread data leakage if the package is used.

No official patch or remediation is currently available. Users should avoid installing the @s4yhiitestpoc/r2-https package version 1.0.0. Review and audit npm packages before installation, especially those from untrusted or unknown sources. Monitor for suspicious network activity related to npm installs. Check vendor advisories or npm security advisories for updates or removal notices regarding this package.