Threats Tagged 'mal-2026-5693'

The npm package 'sea-bound-siren' contains malicious code that executes during installation. It collects sensitive environment data, including system identifiers, environment variables, npm configuration files, and searches for secrets and flags within the application directory. This data is exfiltrated in base64-encoded form over unencrypted HTTP to a hardcoded external server. The payload activates only under specific conditions to evade detection, including checks for containerized environments and avoidance of certain Chinese npm mirrors. The exfiltration of .npmrc files can expose authentication tokens, enabling attackers to publish malicious packages under the victim's npm identity. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately from a clean environment.