Malicious code in self-certificates (npm)

The 'self-certificates' npm package includes a malicious payload disguised as a self-signed TLS certificate. The key.pem file contains base64-encoded JavaScript that, when decoded and executed by the 'self-sign' dependency, fetches remote code from 'https://aptupdate.org/settings/privacy.php' and executes it in a hidden Python3 process. This technique uses a PEM format wrapper to smuggle and execute arbitrary code, resulting in a multi-stage dropper that compromises the host system upon installation or execution of the package.

Any system with this package installed or running is considered fully compromised. The attacker gains arbitrary code execution capabilities, potentially leading to complete control over the affected machine. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure, unaffected environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is indicated in the available data. Immediate removal of the 'self-certificates' package is recommended. Due to the high likelihood of full system compromise, all credentials and keys stored on the affected system should be rotated from a different, secure machine. Conduct a thorough investigation and system remediation to ensure no persistent malicious code remains.