Malicious code in @stellarshift/chain-metadata (npm)

The @stellarshift/chain-metadata npm package (versions 1.0.1 and 1.0.3) includes a postinstall lifecycle script that retrieves and executes code from an XOR-encoded URL decoded at runtime. The remote URL points to an anonymous Tencent Cloud COS bucket unrelated to the package publisher. On Unix systems, the payload is executed via a bash pipe; on Windows, via PowerShell with hidden process flags. Execution is restricted to environments where both Lark or Feishu clients and FortiClient VPN are installed, and it avoids running in CI environments by checking environment variables. This targeted execution aims to compromise corporate developer machines stealthily. The package's README misleadingly claims no network activity and zero runtime dependencies, which is false. The malicious code grants full control over the infected system.

Any system with this package installed or running is considered fully compromised. Attackers may gain complete control over the machine, potentially accessing all stored secrets and keys. Because of the deep compromise, simply removing the package does not guarantee removal of all malicious artifacts. Immediate rotation of all secrets and keys from a separate, uncompromised system is necessary.

No official patch or fix is currently documented. Users should immediately remove the affected package versions (1.0.1 and 1.0.3) from their systems. All secrets and keys stored on compromised machines must be rotated from a different, secure device. Due to the nature of the compromise, consider rebuilding or reimaging affected systems to ensure complete removal of malicious code. Monitor for any signs of persistence or further compromise.