The 'worker-build' npm package versions 9.0.0, 9.0.1, and 9.0.2 includes a postinstall script that runs 'main.js' during installation. This script gathers host identity details (hostname, username, home directory, current working directory, command-line arguments), reads the consumer's package.json, retrieves git remote URLs, and extracts credential-like environment variables (e.g., AWS keys, tokens, passwords). It sends this collected data as a JSON payload in cleartext via HTTP POST requests to a known malicious domain and performs DNS lookups as side-channel beacons. The package name is designed to mimic legitimate Cloudflare Workers tooling, increasing the risk of dependency confusion attacks. The package is identified as malicious by multiple sources including Amazon Inspector, GHSA malware reports, and OpenSSF Package Analysis.

Installation of any affected version of the 'worker-build' package results in immediate execution of malicious code that can exfiltrate sensitive environment variables and system information to an attacker-controlled server. This compromises all secrets and credentials stored on the host, potentially leading to full system compromise and unauthorized access to connected services. The presence of this package indicates a high likelihood of compromise, and removal alone may not eliminate all malicious artifacts.

There is no official patch or fix available for this malicious package. Users should immediately remove all instances of 'worker-build' versions 9.0.0, 9.0.1, and 9.0.2 from their environments. All secrets and credentials exposed to the compromised system must be rotated from a secure, unaffected machine. Due to the potential for full system compromise, a thorough security assessment and remediation of the affected host is strongly recommended.