Malicious code in self-sign (npm)

The self-sign npm package versions including 5.6.1 through 5.6.9 (specifically =5.6.1, =5.6.2, =5.6.3, =5.6.4, =5.6.5, =5.6.6, =5.6.7, =5.6.8, =5.6.9) contain a malicious code pattern in the exported generate() function. This function accepts an undocumented third parameter 'defaults' which, if passed a string, strips PEM certificate headers and base64-decodes the body, then passes the decoded content to eval() inside a silent try/catch block. This behavior is concealed by the TypeScript declaration file and README examples, allowing downstream callers to unknowingly propagate attacker-controlled input into an eval sink, resulting in arbitrary code execution. The package name differs from the require identifier used in documentation, potentially causing confusion with the legitimate selfsigned library. The presence of this package indicates a fully compromised system.

Systems with the affected self-sign package installed are considered fully compromised due to arbitrary code execution via the eval() call on attacker-controlled input. This can lead to complete system takeover, exposure of secrets, and unauthorized control. All secrets and keys on affected systems should be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is indicated in the provided data. Immediate removal of the self-sign package versions listed is recommended. Treat any system with this package as fully compromised and rotate all secrets and keys from a different, secure system. Investigate for potential persistence or additional malicious software installed as a result of this compromise. Monitor for any unusual activity and consider rebuilding affected systems.