@tonsdk/core is a malicious npm package impersonating the legitimate TON SDK. Its postinstall.js script automatically runs on installation, sending a base64-encoded JSON fingerprint of the host (hostname, username, platform, architecture) to a hardcoded IP address over plaintext HTTP. It then retrieves a payload from the attacker-controlled server, optionally XOR-decrypts it, and executes it via eval(), allowing arbitrary remote code execution within the Node.js process. The script also probes for virtualization or analysis tools (vmtoolsd, vboxservice, wireshark, x64dbg, ida) to avoid execution in researcher environments. The package targets developers searching for TON SDK tooling but is unrelated to the official TON foundation repository. The affected version is exactly 0.9.3.

Installation of this package results in full compromise of the host system. Host identifying information is leaked to an attacker-controlled server, and arbitrary code execution is granted to the attacker during installation. This can lead to complete system takeover, data theft, and persistence of malicious software. Secrets and keys stored on the compromised system should be considered exposed and rotated immediately. Removing the package alone may not remove all malicious artifacts.

No official patch or fix is available. The package should be removed immediately if installed. Because the system is considered fully compromised, all secrets and keys stored on the affected computer must be rotated from a separate, trusted system. Monitor for any signs of persistent malicious activity and consider rebuilding the affected system. Avoid installing packages from untrusted or impersonating sources and verify package authenticity before installation.