Malicious code in sea-bound-siren (npm)

The 'sea-bound-siren' npm package includes a postinstall script that runs a shell pipeline to gather detailed system information such as user ID, hostname, environment variables, and contents of npm configuration files. It recursively searches the application directory for secrets and flags, then base64-encodes the collected data and sends it in two parts via HTTP PUT requests to a hardcoded external IP address. Execution is gated by an 'isChallengeWorker()' function that requires the current working directory to be within '/app/node_modules', a 12-character hexadecimal hostname (typical of Docker container IDs), and the presence of specific files like 'Cargo.toml' or 'package.json'. The payload suppresses execution if the npm registry is a known Chinese mirror, indicating environment fingerprinting to avoid analysis. The exfiltration of '.npmrc' files risks leaking npm authentication tokens, allowing attackers to impersonate victims in the npm ecosystem. The package is considered fully malicious, and any system with it installed is likely compromised.

Installation of this package results in the exfiltration of sensitive system and environment data, including npm authentication tokens, to an attacker-controlled server. This compromises the confidentiality of secrets and credentials stored on the system. The attacker may gain the ability to publish malicious npm packages under the victim's identity, leading to supply chain compromise. The presence of this package indicates a full system compromise, requiring immediate secret rotation and remediation.

No official patch or fix is available for this malicious package. Immediate removal of the 'sea-bound-siren' package is required. All secrets, authentication tokens, and keys stored on the affected system should be rotated from a separate, trusted environment. Due to the potential full compromise, assume the system is untrusted and consider rebuilding or thoroughly investigating for additional persistence mechanisms. Monitor for any unauthorized npm package publications using compromised tokens.