Malicious code in signup-embedder (npm)

The signup-embedder npm package in versions 99.99.99-poc2, 99.99.99-poc3, and 99.99.99 includes malicious lifecycle scripts (preinstall.js and postinstall.js) that execute automatically upon npm install. These scripts collect host identifiers such as hostname, current working directory, process ID, Node.js version, platform/architecture, user, and environment variable names. This data is exfiltrated via HTTP POST requests to a webhook.site URL controlled by an attacker. Additionally, a DNS lookup is performed for out-of-band confirmation. Despite being labeled as a 'HubSpot dependency confusion PoC,' the package is publicly published and can be resolved by any npm installer, leading to exposure of internal environment details and enabling further targeting. The presence of this package on a system indicates a high risk of compromise.

Systems that install any of the affected versions of signup-embedder are at risk of full compromise. The malicious scripts exfiltrate sensitive host environment information, which can facilitate internal network mapping and subsequent targeted attacks. According to the source, any computer with this package installed or running should be considered fully compromised, necessitating immediate rotation of all secrets and keys from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious artifacts or access.

No official patch or fix is indicated for this malicious package. The recommended mitigation is immediate removal of the signup-embedder package from all affected systems. All secrets and keys stored on compromised machines should be rotated immediately using a separate, trusted device. Due to the potential for full system compromise, a thorough incident response and forensic investigation are advised to identify and remediate any persistent threats beyond the package itself.