If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (2c18cc0d6d922eb6bbfcb565415772dbd0bb246ca7595f18afe1f87f2f6c1a33)
The npm postinstall script in array-sort-helper@1.0.0 automatically runs on `npm install` and executes a shell reconnaissance and exfiltration routine. postinstall.js collects hostname, user, pwd, `uname`, container/docker markers, process tree, GitHub Actions CI variables (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID, RUNNER_NAME, CI), local IPs, /etc/resolv.conf, AWS and Tencent cloud instance-metadata (IMDS) probes, and a full dump of process environment variables (filtering only npm_* noise). The collected data is base64-encoded and sent via HTTP GET to a hardcoded Burp Collaborator subdomain at pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/z?d=<base64>. The package presents itself as an array-sort utility but ships no such functionality; index.js contains unrelated color helper code. The behavior is credential and secret harvesting targeted at CI runners and cloud workloads.
Source: ossf-package-analysis (6cade78851ee1586c3bbf22b8c1393e0c2f8e51ac6c8496aaaf50cda425807cc)
The OpenSSF Package Analysis project identified 'array-sort-helper' @ 1.0.0 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.