Malicious code in vs-modules (npm)

The 'vs-modules' npm package version 1.2.2 declares a preinstall hook that runs a heavily obfuscated script 'resources.js' during 'npm install'. This script reconstructs a plain-HTTP URL hosted on an anonymous Netlify subdomain, downloads a batch file to the system's temporary directory using 'curl', and executes it immediately via child_process.exec. The lack of integrity checks or HTTPS means the downloaded payload can be manipulated, leading to arbitrary code execution on the installer's machine. The package's legitimate purpose is unrelated to this behavior, indicating intentional malicious activity.

Any system that installs this package version is fully compromised as the malicious batch file executes with the installer's privileges. This can lead to unauthorized access, data theft, or further malware deployment. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately. Removing the package alone does not guarantee removal of all malicious artifacts or persistence mechanisms.

Users should immediately remove the 'vs-modules' package version 1.2.2 from their systems. All credentials and secrets on affected machines must be rotated from a secure, uncompromised environment. Since no official patch or fix is indicated, avoid using this package version entirely. Monitor for any suspicious activity resulting from this compromise and consider full system remediation.