Malicious code in @testrelic/playwright-analytics (npm)

The @testrelic/playwright-analytics npm package version 2.13.0 includes a postinstall lifecycle script (scripts/postinstall.cjs) that runs automatically upon installation. This script contains a large whitespace padding to conceal an obfuscated payload, which reconstructs and executes code dynamically using indirect invocation of the Function constructor to evade static detection. The payload assigns require, module, __dirname, and __filename to the global object, allowing it to load arbitrary Node.js built-in modules. The package's bundled files also require 'child_process' and perform outbound HTTP POST calls and ping commands, indicating potentially malicious behavior inconsistent with its stated functionality.

Installation of this package version results in execution of obfuscated malicious code with the ability to run arbitrary Node.js commands and make outbound network connections. This can lead to unauthorized code execution, data exfiltration, or system compromise on any system where the package is installed.

No official patch or remediation is currently documented. Users should avoid installing version 2.13.0 of @testrelic/playwright-analytics. If already installed, remove the package and audit systems for unauthorized activity. Monitor vendor advisories for updates or fixes. Since this is not a cloud service, remediation depends on user action.