Malicious code in tset_racie (npm)

The tset_racie npm package versions 1.0.1 and 1.0.3 include a single obfuscated JavaScript file that contains a 551-entry RC4-encrypted string array and a base64+RC4 decoder. It employs anti-debugging techniques by regex-testing function toString outputs to detect debugging or beautification attempts. The code dynamically assembles and executes a payload using the Function constructor, resulting in immediate execution of arbitrary code upon requiring the package. The package metadata is minimal and suspicious, consistent with short-lived malicious packages. Although the exact payload function (e.g., exfiltration, credential theft, dropper) cannot be determined statically, the presence of encrypted runtime-executed code and anti-debugging confirms malicious intent.

Any system that installs or runs the tset_racie package versions 1.0.1 or 1.0.3 is fully compromised. The malicious code executes immediately, potentially allowing attackers full control over the system. All secrets and keys stored on the compromised system should be considered exposed and must be rotated from a secure environment. Removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the code.

Remove the tset_racie package versions 1.0.1 and 1.0.3 immediately from all systems. Rotate all secrets, credentials, and keys that were stored or used on affected systems from a different, uncompromised machine. Conduct a thorough investigation and remediation of the affected systems, as the package grants full control to attackers and may have installed additional malware. There is no official patch or fix; the package itself is malicious and should not be used.