Malicious code in @testrelic/appium-analytics (npm)

The @testrelic/appium-analytics npm package version 1.1.1-next.88 includes a postinstall hook script (scripts/postinstall.cjs) that uses a custom obfuscation technique to reconstruct the 'constructor' string and obtain the Function constructor. This allows execution of a decoded payload at install time, which has access to Node.js internals such as require, module, __dirname, and __filename via obfuscated global variables. The package's distribution bundle imports child_process and performs POST/GET network calls from multiple files, indicating malicious behavior beyond legitimate analytics functions. This install-time execution and scope-escape technique is characteristic of malware droppers. The package compromises any system where it is installed.

Systems that have installed this package version are fully compromised. The malicious payload runs automatically during installation, potentially allowing arbitrary code execution with access to filesystem and network. Secrets and keys stored on the compromised system may be exposed and should be rotated immediately. Removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the payload.

Remove the @testrelic/appium-analytics package version 1.1.1-next.88 from affected systems immediately. Rotate all secrets and keys stored on compromised machines from a separate, trusted environment. Due to the nature of the compromise, consider full system reimaging or forensic analysis to ensure complete removal of malicious code. Monitor for any suspicious activity related to this package installation.