Malicious code in ve-hemi-rewards (npm)

The 've-hemi-rewards' npm package at version 999.0.0 contains malicious code triggered during the preinstall lifecycle. The package runs a postinstall.js script that collects system information and filters environment variables for keys related to secrets and credentials (e.g., tokens, passwords, API keys). It then serializes and sends this data via HTTPS POST to a hardcoded IP address (185.130.46.35:8443/collect). This package exemplifies a dependency confusion attack, where a high-version public package is published to override a private package with the same name, enabling attackers to steal sensitive installation environment secrets. No legitimate functionality is present in this package.

Sensitive environment variables including CI tokens, cloud credentials, SSH keys, API tokens, and other secrets can be exfiltrated to an attacker-controlled server during package installation. This can lead to credential compromise and potential further attacks on the victim's infrastructure or accounts. The malicious package does not provide any legitimate functionality and is solely designed for secret harvesting.

Avoid installing the 've-hemi-rewards' package version 999.0.0 from public npm registries. Verify package sources and use scoped or private registries to prevent dependency confusion attacks. Remove any instances of this package from your dependency tree. Rotate any secrets that may have been exposed if this package was installed. Monitor for unexpected network connections to suspicious IP addresses during package installation.