Malicious code in ssb-test-package (npm)

ssb-test-package version 1.0.0 is a proof-of-concept malicious npm package that exploits dependency confusion by using a preinstall hook to run arbitrary code on the host during installation. The preinstall script (poc.js) collects reconnaissance data such as OS user, hostname, platform, architecture, Node.js version, current working directory, and network interface addresses, then writes this data to a local JSON file. The package does not contain any legitimate library code (index.js is missing), and no network exfiltration occurs. This demonstrates the potential for remote code execution (RCE) via npm dependency confusion attacks.

The package enables arbitrary code execution on the host system at install time, allowing an attacker to gather detailed system reconnaissance data. Although this specific package does not exfiltrate data over the network, the capability to run code during installation poses a significant security risk, potentially leading to further compromise if exploited in a real attack scenario.

No official patch or remediation is available for this package as it is a proof-of-concept malicious package. Users should avoid installing [email protected] or any similarly suspicious packages, especially those with unexpected or undocumented preinstall scripts. Employ strict dependency management and verification practices to prevent dependency confusion attacks. Monitor package sources carefully and use tools that detect malicious or unexpected install scripts.