Malicious code in @shell-landing/routes (npm)

The '@shell-landing/routes' npm package version 99.9.5 includes a postinstall hook that executes a script 'scream3gg.js' to hex-encode and exfiltrate host identity information (hostname, home directory, username) via HTTP GET requests to attacker-controlled subdomains. Additionally, it uses curl to POST the contents of the host's /etc/passwd file to another attacker-controlled domain embedding the hostname. The package contains no legitimate library code and is consistent with a malicious dependency confusion probe. Installation leads to leakage of sensitive host data to attacker infrastructure and likely full system compromise.

Installation of this package results in exfiltration of sensitive host information including /etc/passwd contents and user identity details to attacker-controlled infrastructure. The package's presence indicates a full compromise of the affected system, potentially allowing attackers to access all secrets and keys stored on the host. Removal of the package alone does not guarantee eradication of all malicious artifacts or backdoors.

Remove the '@shell-landing/routes' package version 99.9.5 immediately from all affected systems. Rotate all secrets, credentials, and keys that were stored on the compromised host from a secure, unaffected environment. Conduct a thorough investigation for additional persistence mechanisms or malware introduced by the attacker. There is no official patch or fix; remediation requires manual removal and incident response.