Malicious code in spc-grafeno (npm)

The spc-grafeno npm package version 1.0.0 includes a preinstall lifecycle script that runs a shell command fetching and executing a script from the IP 216.126.236.46 via plain HTTP. This script is executed immediately during npm install, providing the attacker with remote code execution on the installer's system. Additionally, the script appends the same command to the user's ~/.bashrc file and schedules a cron job to run the command every 30 minutes, ensuring persistent execution of the attacker's code. This behavior constitutes a malicious package designed to compromise the host system.

Successful installation of spc-grafeno version 1.0.0 leads to immediate remote code execution on the installer's machine. The attacker gains persistent access through modifications to the user's shell configuration and scheduled cron jobs, allowing repeated execution of malicious code without further user interaction.

No official patch or remediation is currently documented for this malicious package. The best mitigation is to avoid installing spc-grafeno version 1.0.0 entirely. Users should verify package authenticity before installation and remove any instances of this package if found. Manual removal of the malicious entries in ~/.bashrc and crontab is necessary to eliminate persistence if the package was installed.