Malicious code in techportal (npm)

The 'techportal' npm package version 4.0.10 includes a preinstall script 'beacon.js' that runs automatically on 'npm install'. This script collects sensitive host information (os.hostname(), os.userInfo().username, process.cwd()), base32-encodes it, and sends it to a hardcoded IP address (http://45.76.249.245) via HTTP GET with custom headers. If the HTTP beacon fails or times out, the same data is exfiltrated through DNS tunneling by encoding it into DNS subdomain labels and querying attacker-controlled domains (*.oob.asm5.net). This behavior occurs without user opt-in or configuration, effectively leaking installer host identity to attacker infrastructure.

The malicious code leaks sensitive host identity information from the machine performing the npm install, including hostname, username, and current working directory. This data is sent to attacker-controlled infrastructure via HTTP and DNS channels, potentially exposing internal environment details and enabling further targeted attacks or reconnaissance. The DNS tunneling technique can bypass network egress controls that block HTTP traffic, increasing the risk of unnoticed data exfiltration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal of the malicious package is confirmed, avoid installing 'techportal' version 4.0.10 from untrusted sources. Consider auditing npm dependencies for unexpected preinstall scripts and monitor network traffic for suspicious connections to the indicated IP address and domains. If possible, restrict DNS and HTTP egress to prevent unauthorized data exfiltration.