Malicious code in simplisafe-gatsby (npm)

The simplisafe-gatsby npm package (version 1.0.1) contains a preinstall hook that runs a Node.js script (index.js) upon installation. This script collects detailed system information including the installer's hostname, username, home directory, DNS configuration, package metadata, and sensitive files (/etc/passwd and /etc/hosts). It then sends this data via HTTPS POST to a Burp Collaborator subdomain controlled by the attacker. The package has no legitimate functionality and is likely a dependency confusion attack against SimpliSafe's internal Gatsby package namespace. Installation results in exfiltration of sensitive system and local account information, effectively compromising the host.

Any machine that installs simplisafe-gatsby version 1.0.1 will leak sensitive system and user information to an attacker-controlled server. This exposure includes local account details and network configuration, which can facilitate further compromise. The presence of this malicious package indicates full system compromise, requiring immediate secret and key rotation. Removal of the package alone may not eliminate all malicious artifacts or backdoors introduced during installation.

No official patch or fix is available for this malicious package. The affected package version is 1.0.1. Systems that have installed this package should be considered fully compromised. Immediate actions include removing the package and rotating all secrets and keys from a different, trusted machine. Due to the potential for persistent compromise, a full system rebuild or forensic investigation is recommended. Avoid installing packages from untrusted or suspicious sources, and verify package authenticity before installation.