Malicious code in twapfetch (npm)

The twapfetch npm package (versions 1.1.0 and 1.1.1) includes a postinstall script that, upon npm install, downloads a tarball from a URL controlled by environment variables or the package.json homepage field. This tarball is extracted and installed without any version pinning, hash verification, or signature checks, allowing arbitrary code execution on the installer's machine. The package's advertised purpose as a Polymarket Chainlink TWAP WebSocket client is not implemented; instead, the postinstall script acts as a malicious dropper. This behavior indicates that any system installing this package is at risk of full compromise.

Any computer with this package installed or running should be considered fully compromised. Attackers may have gained full control over the system, potentially accessing all secrets and keys stored on it. Removing the package alone does not guarantee removal of all malicious components introduced during installation.

Immediate removal of the twapfetch package versions 1.1.0 and 1.1.1 is recommended. All secrets and keys stored on the compromised system should be rotated from a separate, trusted machine. Due to the nature of the compromise, a full system investigation and remediation may be necessary. No official patch or fix is indicated; users should avoid installing this package.