Malicious code in @stellarshift/token-units (npm)

The @stellarshift/token-units npm package versions 1.0.1 and 1.0.3 includes a postinstall script that reconstructs a URL via XOR-decoding and downloads a remote script which it executes without integrity verification. The execution is gated by environment checks requiring the presence of collaboration clients Lark or Feishu and the FortiClient VPN, while skipping CI environments. This malicious behavior diverges from the package's advertised BigInt token-unit conversion helpers. The package effectively compromises any system where it is installed, potentially allowing full control by an external attacker.

Any computer with this package installed should be considered fully compromised. The malicious postinstall script can execute arbitrary code with the privileges of the user installing the package. This may lead to theft of secrets, keys, and other sensitive data. Removal of the package does not guarantee elimination of all malicious components, as the attacker may have established persistent control. Immediate rotation of all secrets and keys from a separate, uncompromised system is required.

Remove the @stellarshift/token-units package versions 1.0.1 and 1.0.3 immediately. Consider the affected system fully compromised and perform a thorough incident response. Rotate all secrets and keys from a different, trusted computer. There is no known patch or fixed version available. Avoid installing this package and monitor for any presence of it in your environment.