Malicious code in tn-advertisement (npm)

The 'tn-advertisement' npm package (version 5.0.0) contains malicious code embedded in its main entry file (postinstall.js). Upon requiring the package, it performs an unconditional HTTP GET request to a unique subdomain of oastify.com, a Burp Suite Collaborator out-of-band testing infrastructure. This outbound beacon discloses the installer's public IP address and DNS resolver information to the attacker controlling the subdomain, confirming code execution on the victim's machine. The package has no advertised legitimate functionality and is consistent with dependency-confusion reconnaissance payloads used to verify successful supply-chain compromise before further exploitation. The presence of this package on a system should be treated as a full compromise.

Any system that has installed or is running the 'tn-advertisement' package version 5.0.0 should be considered fully compromised. The malicious code allows an external attacker to confirm code execution on the victim machine and potentially gain full control. All secrets and keys stored on the compromised system are at risk and should be rotated immediately from a secure, unaffected environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Immediate removal of the 'tn-advertisement' package version 5.0.0 is recommended. However, due to the high likelihood of full system compromise, all secrets and credentials stored on the affected machine should be rotated from a different, trusted device. Conduct a thorough investigation and remediation of the affected system, including checking for persistence mechanisms and other malware. No official patch or fix is available for this malicious package; remediation relies on removal and incident response.