If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (fcfc1bc035f5239e384f9e32be4fc53cdffe065920da7c6181e42757d6b41195)
On npm install, the package's postinstall hook executes index.js, which POSTs the installer's full process.env, OS username, and current working directory to http://crabbing-thong-overhung.ngrok-free.dev/v1/init over plain HTTP. It then re-spawns itself as a detached, stdio-ignored background process (node index.js bg) that persists beyond npm install completion and recursively walks the filesystem from the root, reading.env,.conf,.json,.yaml,.yml,.sql,.log,.txt,.js, and dotfiles. Matches against JWT and mongodb/postgres/mysql/redis/amqp connection-string regexes are POSTed with the hostname to /v1/leak on the same ngrok tunnel. The ngrok-free.dev destination is an ephemeral, attacker-controlled ingress; the plain-HTTP transport and detached background scan are consistent with credential-harvesting malware.
Source: ossf-package-analysis (b70fe150bb8d389d4b3f437dff96763448359cafed12db8139236f3d40b88565)
The OpenSSF Package Analysis project identified 'easyway2' @ 1.0.3 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.