Malicious code in token-prices-cron (npm)

The 'token-prices-cron' npm package version 999.0.0 includes a preinstall script (postinstall.js) that enumerates environment variables, filters keys matching a broad credential regex (including terms like key, secret, token, pass, private, ssh, deploy, auth, api, rpc, wallet, sentry, docker, graph, slack, host), and collects these along with hostname, username, current working directory, and npm registry/prefix metadata. This collected information is sent via an HTTP POST request to a hardcoded IP address (185.130.46.35) on port 8443 without TLS or domain verification. The package itself exports an empty module and uses a high version number (999.0.0) to win resolution against private registry packages, facilitating credential harvesting on corporate continuous integration environments. A source comment explicitly states the intent to exfiltrate CI environment variables on install.

This malicious package can lead to the exfiltration of sensitive environment variables and credentials from build or development environments where it is installed. The stolen data includes secrets, tokens, passwords, private keys, and other sensitive information that could compromise corporate infrastructure, CI/CD pipelines, and connected services. The attack leverages dependency confusion to increase the chance of installation in targeted environments.

No official patch or remediation is available for this malicious package. The package should be removed and blocked from use in all environments. Organizations should audit their dependency sources to prevent dependency confusion attacks by using strict package name controls and private registries. Monitoring for unexpected packages with suspicious versioning or empty module exports can help detect similar threats. Avoid installing packages from untrusted sources and verify package authenticity before use.