If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (b88fd82e9d147a4fad43b89bab0b975fe57714abf16356eb39ec0ae62dcc7949)
index.js opens a TCP connection to a base64-obfuscated IP address (decodes to 85.137.253.124:1111), spawns /bin/sh, and pipes the shell's stdin/stdout/stderr through the socket, giving the remote endpoint an interactive shell on the installer's host. package.json declares "postinstall": "node install.js"; install.js uses node-linux's Service API to install index.js as a Linux systemd service named CustomBot and starts it, aborting unless run as root and prompting the user to run `sudo npm i`. The combination provides remote code execution against the installer with root privileges and reboot persistence. The C2 IP is stored as the base64 literal 'ODUuMTM3LjI1My4xMjQ=' and decoded at runtime, consistent with deliberate concealment.
Source: ossf-package-analysis (07c87d7c1e7e788959af6de895c76293fd0922dd1a422da325962de7f8d3d19a)
The OpenSSF Package Analysis project identified '@custombots/custombot' @ 1.0.0 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.