Malicious code in ts-bn-lint-helper (npm)

The ts-bn-lint-helper npm package version 3.1.19 contains embedded malicious code in its index.js file that, when invoked, recursively scans the current working directory for files named id.json, config.toml, Config.toml, config.json, env, and .env, and uploads them to a remote server via an axios POST request. It also harvests shell history from common shell history files such as ~/.bash_history, ~/.zsh_history, fish history, ~/.sh_history, and PowerShell's PSReadLine ConsoleHost_history.txt, using fallback shell commands executed via execSync if necessary. The exfiltration URL and file patterns are base64-encoded to evade simple detection. The malicious function from_str() is automatically called during npm test execution. The package metadata is sparse and designed to appear legitimate, increasing the risk of unsuspecting developers installing and running it.

Any user or system that installs ts-bn-lint-helper version 3.1.19 and executes the from_str() function or runs npm test will have sensitive files and shell history from their working directory and home directory exfiltrated to an attacker-controlled server. This leads to credential leakage and exposure of potentially sensitive environment configuration and command history, which can be leveraged for further attacks or unauthorized access.

No official patch or remediation is currently documented. Users should immediately remove ts-bn-lint-helper version 3.1.19 from their projects and avoid executing npm test or calling from_str() from this package. Audit dependencies for this package and replace it with trusted alternatives. Monitor for any suspicious network activity related to data exfiltration. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.