Malicious code in tostpro (npm)

The npm package [email protected] includes a preinstall lifecycle hook that runs a shell script (test.sh) on npm install. The script reconstructs and executes a curl command that, after October 4, 2026, posts the installer's environment variables (which may contain sensitive information such as CI tokens, cloud credentials, and API keys) to https://abbishal.com/sh/poc. The code uses string-splitting obfuscation and a time-bomb gate to evade detection. The README misleadingly states that there is no network access or data collection, indicating intentional concealment of malicious activity.

If triggered, this malicious code can exfiltrate sensitive environment data from the installation environment, including credentials and tokens, potentially leading to unauthorized access and compromise of systems relying on those credentials. The time-bomb mechanism delays activation until after October 4, 2026, which may allow the package to evade early detection and analysis.

No official patch or remediation is currently documented. Users should avoid installing the affected versions of tostpro. Review and remove any installations of [email protected], 100.6.0, and 100.7.0. Monitor for any suspicious network activity related to https://abbishal.com/sh/poc. Check the vendor advisory or npm security advisories for updates or fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.