The velabuild npm package versions 1.0.0, 1.0.1, 1.0.2, 1.0.3, 2.0.0, 2.1.0, 2.1.1, and 2.2.0 embed a base64-encoded RSA private key within the CLI code. This key is decoded to a temporary file with restricted permissions and used to SSH into a remote server controlled by the attacker. This SSH access allows execution of bash scripts on the attacker's server related to signup, login, and deploy commands. The private key is shipped identically to all users, meaning any installer gains unauthorized access to the attacker's server. The package does not fetch or execute remote code during installation but enables remote command execution when certain subcommands are explicitly run by the user. The signup and login subcommands pass user credentials as shell arguments over the SSH tunnel. Due to this, any system with this package installed should be treated as fully compromised.

Systems with the affected velabuild package installed are fully compromised because the embedded private key grants unauthorized SSH access to the attacker's server. This access can lead to remote command execution and potential data exfiltration or further compromise. User credentials passed during signup/login commands are exposed over the SSH tunnel. The compromise extends beyond the package itself, as the attacker may have established persistent control over the system.

No official patch or fix is currently documented. Immediate removal of the velabuild package is recommended. All secrets and keys on affected systems should be rotated from a separate, trusted machine. Given the full compromise risk, affected systems should be considered untrusted and undergo thorough incident response procedures. Monitor for any unauthorized access or persistence mechanisms. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.