Malicious code in selfsigned-certificate (npm)

The 'selfsigned-certificate' npm package versions 1.0.0 and 1.1.0 include a concealed malicious code path in index.js. Invoking generateCertificates with the value 10 causes the function loadSampleCertificates() to fetch a base64-encoded JavaScript payload from a hardcoded remote URL (https://jetpack.cv/wp-json/selfsigned-certs/v3/init) using HTTP Basic Auth credentials stored as base64 literals. TLS certificate verification is disabled (rejectUnauthorized:false), allowing the payload to be fetched without verifying the server's identity. The fetched payload is decoded and executed via eval(), resulting in arbitrary remote-controlled code execution within the host Node.js process. This backdoor is hidden behind a magic-number argument and is not documented, indicating a deliberate attempt to conceal the malicious behavior. The obfuscation and fetch-and-eval pattern classify this as a remote code execution dropper targeting consumers of this package.

Any system with the affected versions of the 'selfsigned-certificate' package installed or running is fully compromised. The attacker can execute arbitrary code remotely within the Node.js process, potentially leading to complete system takeover. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

No official patch or fix is currently documented for this malicious package. Immediate removal of the 'selfsigned-certificate' package versions 1.0.0 and 1.1.0 is strongly recommended. Systems with this package installed should be treated as fully compromised; all credentials and secrets must be rotated from a different, trusted system. Conduct a thorough incident response to identify and remediate any additional malware or persistence mechanisms. Monitor for any suspicious activity related to this compromise.