If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (2794273ee7e40da4b37c017636209acf1402b1104ab5fc265a43cc7d83228e72)
eslint-rxjs is a masquerade package whose npm metadata is internally inconsistent: the name references ESLint/RxJS, the description reads 'Integrate redis with cookies', and the author field impersonates well-known maintainers. The package ships no advertised functionality; index.cjs contains only a beacon helper. The package.json postinstall hook runs scripts/postinstall.cjs, which loads index.cjs and calls onInstall(), unconditionally issuing an HTTP GET to the hardcoded ngrok tunnel https://e493-95-216-46-122.ngrok-free.app/ping at install time. An ngrok-free.app subdomain is ephemeral, attacker-controlled infrastructure with no legitimate use for a published package; the request confirms code execution on the installer's machine and discloses the installer's source IP and install timing to that endpoint. This is the reconnaissance stage of a supply-chain dropper.
Source: ossf-package-analysis (994311f4267205d33ceb2b43d3f7d72767d384dcc286b6962b5cea13489f7280)
The OpenSSF Package Analysis project identified 'eslint-rxjs' @ 1.0.1 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.