Malicious code in savant-listing (npm)

The 'savant-listing' npm package versions 999.9.9 and 999.9.10 contain malicious lifecycle scripts ('install' and 'postinstall') that execute a curl command to exfiltrate the hostname of the host machine to an attacker-controlled OAST (Out-of-band Application Security Testing) domain. This package is a dependency confusion squat, published to the public npm registry with a high version number to override internal packages of the same name. The exfiltration occurs automatically during npm install without any user interaction. The presence of this package on a system indicates likely full compromise, and removal alone may not eliminate all malicious artifacts.

The malicious package automatically leaks the hostname of the installing system to an attacker-controlled server during installation. According to the source, any system with this package installed or running should be considered fully compromised. This implies potential unauthorized access or control by an attacker. All secrets and keys stored on the compromised system should be rotated immediately from a different, secure machine. Removal of the package does not guarantee removal of all malicious software introduced by the package.

No official patch or fix is available for this malicious package as it is a dependency confusion attack involving a malicious package published to the public npm registry. The recommended mitigation is to immediately remove the 'savant-listing' package versions 999.9.9 and 999.9.10 from all affected systems. Additionally, all secrets and keys stored on compromised machines should be rotated from a secure environment. Monitor for any signs of compromise and rebuild affected systems if possible to ensure removal of any persistent malicious components.