Malicious code in @shell-cabinet/routes (npm)

The @shell-cabinet/routes npm package version 99.9.5 includes a postinstall hook that runs a curl command to send the contents of /etc/passwd to a subdomain of oastify.com, an out-of-band data exfiltration service. Additionally, it executes a script that hex-encodes and leaks host information such as hostname, home directory, and username via DNS-encoded HTTP requests to another oastify.com subdomain. These actions occur automatically on installation and are not part of the package's documented functionality. This indicates a supply chain compromise with direct data exfiltration and potential full system compromise.

Any system that installs or runs this package version is at high risk of full compromise. Sensitive system files and host identifiers are exfiltrated to attacker-controlled infrastructure. The compromise may allow attackers to gain unauthorized access and control over the affected system. All secrets and credentials stored on the compromised system should be considered exposed and must be rotated immediately. Removal of the package alone may not eliminate all malicious artifacts or backdoors introduced.

Immediate removal of the @shell-cabinet/routes package version 99.9.5 is recommended. All secrets, keys, and credentials stored on the affected system must be rotated from a different, trusted machine. Due to the potential full compromise, a thorough system investigation and remediation should be conducted. No official patch or fix is indicated; the package version itself is malicious. Avoid installing this package version and monitor for any signs of compromise.