If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
This package is part of a malicious npm campaign published by the `biz44` account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://api[.]npoint[.]io/24c12c4b66a29747764f other packages →
- hxxps://api[.]npoint[.]io/37c0a0c68bf7a94ed731 other packages →
- hxxp://103[.]170[.]217[.]184:8787 other packages →
IP addresses
- 103[.]170[.]217[.]184 other packages →