Malicious code in triage_bot_using_sdkv3 (npm)

The triage_bot_using_sdkv3 npm package version 2.0.1 registers a preinstall hook that runs a script (index.js) during npm install. This script collects system identifiers and sensitive local files, then exfiltrates this data via HTTPS POST to a hardcoded Burp Collaborator domain controlled by an attacker. The package's presence indicates a full system compromise, and all secrets and keys on the host should be considered compromised.

Installing this package results in disclosure of sensitive system information to an attacker-controlled endpoint. The compromise is severe enough that the affected system should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different, trusted system. Removal of the package alone does not guarantee eradication of all malicious components.

No official patch or fix is available. The package should be immediately removed from any affected systems. All secrets and keys stored on the compromised system must be rotated from a separate, secure environment. Due to the severity of the compromise, a full system investigation and remediation is recommended.