@telekom-ods/[email protected] includes a preinstall hook that runs a shell command to collect system information and sensitive files (/etc/passwd, /etc/hosts, id output, and conditionally /etc/shadow). This data is exfiltrated by embedding it in the User-Agent header of an HTTP POST request to a callback URL hosted on an out-of-band interaction service (OAST). The callback URL path also includes the victim's username and hostname, allowing the attacker to fingerprint compromised hosts. The package was published by the same maintainer account as legitimate releases, suggesting a compromised maintainer token or supply-chain injection rather than a namesquatting attack. The malicious package has been fully removed from the npm registry. Systems that installed this version should assume sensitive local files and credentials have been exposed.

Sensitive local system files and user information, including /etc/passwd, /etc/hosts, id output, and potentially /etc/shadow, were exfiltrated to an attacker-controlled server during package installation. This exposure compromises local user credentials and password hashes, posing a risk of unauthorized access and credential theft on affected hosts. The attacker can also fingerprint each compromised system by hostname and username, facilitating targeted follow-up attacks or lateral movement. The compromise stems from a supply-chain attack on a trusted npm package, increasing the risk to environments that automatically install dependencies.

The malicious versions 2.6.0 and 2.6.9 of @telekom-ods/react-ui-kit have been fully removed from the npm registry. Environments that installed these versions should treat local user credentials and password hashes as compromised and perform immediate credential rotation. Review and audit systems for unauthorized access or suspicious activity related to the exfiltrated data. Avoid using these versions and verify package integrity before installation. Monitor for any further advisories from the package maintainer or npm regarding this incident.