Malicious code in sendgrid-sdk (npm)

The malicious sendgrid-sdk npm package mimics official SendGrid packages (@sendgrid/*) but exports an empty object with no SDK features. Its postinstall script collects extensive installer environment data including hostname, reverse DNS, OS user, Active Directory domain details, proxy/VPN signals, OneDrive corporate flags, install directory, and continuous integration repository URLs. This data is exfiltrated via plain HTTP GET requests to a remote IP address (http://46.224.67.169:3000/ping) as query parameters. The package’s primary purpose is reconnaissance for follow-on attacks such as supply-chain compromises or phishing. Despite a README claiming it is a "honeypot," the package is publicly published, and users do not consent to this data collection.

Unauthorized collection and transmission of sensitive environment and user information can lead to targeted supply-chain or phishing attacks. The exposure of corporate Active Directory and CI environment details increases the risk of further compromise. The use of unencrypted HTTP for data exfiltration exposes the data to interception. The impersonation of official packages increases the likelihood of accidental installation by developers.

No official patch or remediation is available since this is a malicious package impersonating legitimate software. Users and organizations should avoid installing sendgrid-sdk and verify package names carefully before installation. Use trusted package sources and consider implementing package allowlists or automated scanning to detect and block malicious packages. Monitor for and remove any instances of this package in existing projects.