Malicious code in test-in-one (npm)

The 'test-in-one' npm package (version 1.0.0) declares a local file dependency 'detector' whose postinstall script executes automatically on npm install. This script scans the installer's home directory and common locations for sensitive data including crypto-wallet directories (e.g., MetaMask, Phantom), SSH private keys, AWS credentials, Git credentials, environment files, and npm/yarn config files. The collected data is archived and sent to a hardcoded Telegram Bot API endpoint. The script also contains code to steal the npm authentication token, enumerate all packages owned by the maintainer, download their tarballs, inject malicious postinstall hooks, increment versions, and prepare them for republishing with the stolen token. The actual republishing is currently disabled by a conditional gate. The use of a local file dependency allows the malicious code to run lifecycle scripts without fetching from the registry, making the package manifest itself the delivery vector.

Sensitive user data including private keys, credentials, environment variables, and npm tokens can be exfiltrated to an attacker-controlled endpoint. This compromises user security and privacy, potentially leading to unauthorized access to crypto wallets, cloud services, source code repositories, and npm package publishing rights. The malicious code also attempts to propagate by injecting itself into other packages owned by the same maintainer, increasing the risk of wider compromise within the npm ecosystem.

No official patch or remediation is currently documented. Users should avoid installing version 1.0.0 of the 'test-in-one' package. Review and revoke any potentially compromised credentials and tokens, including npm tokens, SSH keys, AWS credentials, and crypto wallet keys. Monitor for unauthorized package publications from affected maintainers. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates and remediation guidance.