The 'yelp-react-component-chaos' npm package at version 8.14.5 performs malicious actions during installation by collecting hostname, username, current working directory, network interfaces, environment variables matching sensitive keywords, and probing for the existence and sizes of critical credential files such as ~/.npmrc, ~/.gitconfig, SSH keys, AWS credentials, and Docker config files. This collected information is exfiltrated via an unencrypted HTTP POST request to a domain associated with malicious activity. The package name is a dependency confusion squat targeting Yelp's private registry namespace, enabling attackers to fingerprint developer or CI hosts and gather credential inventories for targeted follow-on attacks. Due to the nature of the compromise, any system with this package installed should be treated as fully compromised.

Systems that install this package leak sensitive host and credential information to an attacker-controlled server, potentially exposing secrets such as tokens, passwords, SSH keys, AWS credentials, and other environment secrets. This can lead to unauthorized access, credential theft, and further compromise of the affected environment. The package's presence indicates a dependency confusion attack vector, increasing the risk of supply chain compromise.

Remove the 'yelp-react-component-chaos' package version 8.14.5 immediately from all affected systems. Consider all hosts with this package installed as fully compromised. Rotate all secrets and credentials that may have been exposed, including tokens, passwords, SSH keys, AWS credentials, and any other sensitive information, from a separate, clean environment. Due to the potential for persistent compromise, conduct thorough incident response and forensic analysis to identify and remediate any additional malicious artifacts or backdoors. Monitor for any signs of follow-on attacks leveraging stolen credentials.