Malicious code in spf-analytics (npm)

The spf-analytics package (version 1.0.0) includes a heavily obfuscated browser script designed to listen for a specific window event ('gokwik_events') and harvest extensive customer PII such as name, phone, email, full address, city, state, country, postal code, cart line items, order total, and payment method. This data is encrypted using a hardcoded RSA-OAEP public key wrapping an AES-GCM session key and exfiltrated via POST requests to https://connector.internalwebhooks.com/spf-analytics, a non-first-party endpoint unknown to the storefront operator. The script uses localStorage to cache fingerprints to avoid duplicate data uploads and employs obfuscation techniques to hide the endpoint URL, encryption keys, event names, and captured fields, preventing casual inspection and detection. The package masquerades as an analytics tool but functions as a data exfiltration backdoor.

Sensitive customer data including PII and payment information is stolen and transmitted to an unauthorized external server. This compromises customer privacy and can lead to identity theft, fraud, and regulatory violations for the affected storefront operators. The malicious code operates covertly, making detection and mitigation challenging without thorough code review or behavioral monitoring.

No official patch or remediation is currently documented. Operators using spf-analytics version 1.0.0 should immediately remove this package from their storefronts and audit their environments for signs of data exfiltration. Avoid using this package or any untrusted third-party scripts from unverified sources. Monitor network traffic for suspicious POST requests to unknown endpoints. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.