If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (9e41e5ec29fcbb379f86d5a6167b42aec242fede681343996c198b1430e2dffa)
The package's postinstall.js lifecycle script executes a shell pipeline via child_process.exec on npm install. The pipeline reads ~/.ssh/id_rsa, ~/.ssh/authorized_keys, ~/.ssh/known_hosts, ~/.aws/credentials, ~/.bash_history, the full process environment, and host reconnaissance output (whoami, hostname, id, sudo -ln, uname, /etc/os-release, /proc/1/cgroup, /.dockerenv, ps aux, ip addr, ls -la /), base64-encodes the aggregate, and transmits it via curl over plain HTTP to a hardcoded Burp Collaborator subdomain at pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/d. The declared package purpose (string formatting) has no legitimate need to read the installer's SSH private keys or cloud credentials. The name resembles legitimate string-formatting libraries, consistent with typosquatting to lure installations.
Source: ossf-package-analysis (752f3e4fded6d0546e00af595793134c025fd4afd8ee6d8188e0146a608b1cfb)
The OpenSSF Package Analysis project identified 'string-format-kit' @ 1.0.2 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.