Malicious code in tidal-embed-player (npm)

The 'tidal-embed-player' npm package version 1.0.1 declares a preinstall hook that runs a script (index.js) on installation. This script performs host reconnaissance by gathering system identifiers and sensitive files, then sends this information to a Burp Collaborator subdomain controlled by an attacker. The package masquerades as a media player but is purely malicious, enabling potential full system compromise and data exfiltration.

Any system that installs or runs this package should be considered fully compromised. Sensitive information including system user data and configuration files is exfiltrated to an attacker-controlled server. Because the attacker may have gained full control, all secrets and keys stored on the affected system must be rotated from a separate, trusted device. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

There is no official patch or fix available for this malicious package. The package should be immediately removed from all systems. All credentials and secrets stored on affected systems must be rotated from a secure environment. Systems suspected of installing this package should be thoroughly audited and potentially rebuilt to ensure no persistent compromise remains.