Malicious code in @securihackbot/depconf-stage-1792484738 (npm)

This threat involves a malicious npm package '@securihackbot/depconf-stage-1792484738' version 1.0.0 that executes a postinstall script upon installation. The script collects identifying information about the host environment and sends it encoded in a query parameter over plain HTTP to a hardcoded remote endpoint (http://34.143.131.27:18080/x-VA-1/main.js). Additionally, it issues a DNS beacon fallback to a configurable collaborator suffix. The package and its bundled configure.sh workflow are structured to facilitate dependency confusion attacks by being republished under internal scopes, causing internal package resolution to inadvertently install this malicious package from the public npm registry, thereby leaking sensitive host and user information to the attacker.

The impact includes leakage of sensitive environment information such as hostname, local username, platform details, Node.js version, and internal package names to an attacker-controlled server. This can aid attackers in reconnaissance and further exploitation within the victim's environment. The use of plain HTTP for data exfiltration exposes the data to interception. The dependency confusion attack vector increases the risk of this package being installed in internal environments, potentially compromising multiple systems.

No official patch or remediation is indicated in the provided data. Users should avoid installing the '@securihackbot/depconf-stage-1792484738' package version 1.0.0. Organizations should audit internal package scopes and dependency resolution configurations to prevent dependency confusion attacks. Setting the DEPCONF_CALLBACK_URL environment variable to a safe value can override the default exfiltration endpoint, but this is a partial mitigation. Monitoring and restricting npm package sources and verifying package integrity before installation are recommended.