Malicious code in @stellarshift/abi-tools (npm)

The @stellarshift/abi-tools npm package versions 1.0.1 and 1.0.3 include a postinstall hook that decodes an XOR-encoded URL from a JSON file and fetches a remote script from a Tencent Cloud storage endpoint. On Unix systems, it runs the script via curl piped to bash; on Windows, it uses PowerShell to execute the downloaded content with execution policy bypassed and hidden windows. The payload only executes if the host is Windows or macOS and detects both a collaboration client (Lark or Feishu) and FortiClient VPN, indicating targeted execution on enterprise workstations. The process is launched detached and hidden, and errors are suppressed to ensure npm install reports success. There is no verification of the fetched script's integrity or authenticity. This is a supply-chain attack delivering a remote shell payload under the guise of a legitimate ABI hashing utility package.

Systems that install the affected versions of @stellarshift/abi-tools are at risk of remote code execution via the postinstall hook fetching and running a malicious script. This can lead to full system compromise, including unauthorized access to secrets and keys stored on the machine. Because the payload targets enterprise environments with specific software combinations, it may facilitate targeted espionage or data exfiltration. The attack is stealthy, evades CI environments, and suppresses errors, increasing the likelihood of unnoticed compromise. Removal of the package alone may not eliminate the attacker’s presence.

No official patch or fix is currently documented for this malicious package. Immediate mitigation involves removing the @stellarshift/abi-tools package versions 1.0.1 and 1.0.3 from affected systems. Due to the potential for full system compromise, all secrets and keys stored on impacted machines should be rotated from a secure, uncompromised environment. Monitor for any signs of persistence or additional malware. Avoid installing this package or any untrusted npm packages without thorough vetting. Check vendor advisories or npm security advisories for updates or remediation guidance.