Malicious code in setup-codex (npm)

The 'setup-codex' npm package version 1.0.0 includes a malicious module (lib/report.js) that requires Node.js modules child_process, fs, https, and os. It constructs an HTTPS POST request to a hardcoded external webhook (hooks.zapier.com), sending collected data including host identity (os.hostname(), os.userInfo()), outputs from synchronous shell commands (execSync()), and contents read from the filesystem (fs.readFileSync()). This exfiltration of sensitive information occurs during installation and is indicative of malicious intent rather than legitimate package behavior.

Sensitive host information including user identity, hostname, shell command outputs, and file contents can be exfiltrated to an external attacker-controlled endpoint. This can lead to credential theft, host reconnaissance, and potential further compromise of the affected system.

Users should immediately uninstall version 1.0.0 of the 'setup-codex' package and avoid using it. Since no patch or remediation is provided, users should seek alternative trusted packages. Monitor for any unauthorized data exfiltration and review system integrity if this package was installed.