The simple-probe-utils npm package (versions 1.0.0 and 1.0.1) includes a post-installation script that executes shell commands to query cloud instance metadata services such as AWS IMDS (169.254.169.254), Tencent, Aliyun, GCP, and Azure endpoints. It extracts temporary AWS IAM role credentials and appends these credentials, along with the hostname and username, as query parameters in an HTTP request to a hardcoded external domain (pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com). The package.json misrepresents the module as a string formatting helper, but the shipped code contains only the credential-harvesting functionality.

Compromise of temporary AWS IAM credentials can lead to unauthorized access to AWS resources with the permissions granted to the compromised role. This can result in data exfiltration, resource manipulation, or further lateral movement within the cloud environment. The exposure of hostname and username information may aid attackers in targeting or reconnaissance. The malicious code executes automatically during package installation, increasing risk to users who install these versions.

No official patch or remediation is currently documented. Users should immediately avoid installing or using simple-probe-utils versions 1.0.0 and 1.0.1. Remove these versions from any environments where they are installed. Monitor for any unauthorized AWS IAM activity associated with credentials potentially exposed by this package. Consider rotating IAM credentials that may have been compromised. Check vendor advisories or trusted security sources for updates or official fixes.