Malicious code in vega-lite-next (npm)

The vega-lite-next package impersonates the legitimate vega-lite library but lacks any real functionality. Instead, its package.json declares a preinstall script that runs index.js during npm install. This script collects system information including hostname, platform, architecture, user info (username, uid, gid, shell), home directory, current working directory, and the output of 'whoami' and 'id' commands. The collected data is sent as a JSON payload via HTTP POST to a hardcoded Burp Collaborator subdomain controlled by the attacker. This behavior constitutes a supply-chain attack leveraging typosquatting to trick developers into installing malicious code.

The malicious preinstall script can leak sensitive system and user information to an attacker-controlled endpoint. This compromises developer environment confidentiality and may facilitate further attacks. There is no indication of code execution beyond the preinstall script or direct system compromise, but the exfiltration of environment details poses a significant privacy and security risk.

No official patch or remediation is indicated. The best mitigation is to avoid installing the vega-lite-next package and verify package names carefully before installation to prevent typosquatting attacks. Use trusted package sources and consider tools that detect malicious or typosquat packages. Monitor for suspicious network activity during npm installs.