Malicious code in @yuva2210/okx-poc-rce-impact (npm)

@yuva2210/[email protected] is a malicious npm package designed as a dependency-confusion proof-of-concept targeting OKX's internal namespace. Its package.json includes a preinstall script that runs automatically on npm install, executing system commands (whoami, hostname, pwd, id) via child_process.execSync. The output is collected and saved to /tmp/okx-poc-rce-proof.json on the installer's host. The package contains no functional code beyond this reconnaissance payload, resulting in arbitrary code execution at install time if the package is resolved and installed inadvertently.

Installation of this package results in arbitrary code execution on the host machine during npm install, specifically running system commands that collect sensitive host and user environment information. This can lead to unauthorized data collection and potential further exploitation depending on attacker intent. The package does not contain additional payloads beyond this reconnaissance behavior.

No official patch or remediation is available for this package. The best mitigation is to avoid installing or resolving the @yuva2210/okx-poc-rce-impact package, especially in environments where dependency confusion with OKX internal namespaces is possible. Verify package sources and use scoped/internal registries to prevent accidental resolution of malicious public packages. Monitor and audit dependency resolutions to detect unexpected packages.