If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
This package is part of a malicious npm campaign published by the `biz44` account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://api[.]npoint[.]io/641d37178a880b1e8b8f other packages →
- hxxps://api[.]npoint[.]io/33e8d008c334b060adad other packages →
- hxxps://api[.]npoint[.]io/933a731a5e97f4b45249 other packages →
- hxxps://api[.]npoint[.]io/24c25d5f5fcbb0992a4f other packages →
- hxxps://api[.]npoint[.]io/ddae72efbb6714fae922 other packages →
- hxxps://api[.]npoint[.]io/37c0a0c68bf7a94ed731 other packages →
- hxxp://103[.]170[.]217[.]184:8787 other packages →
IP addresses
- 103[.]170[.]217[.]184 other packages →