If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (3cc222b7d4398590749d82ffc06100ca629c6e07970a0f95bcf63889fda19cd3)
idx_form_script@999.0.2 is published with an implausibly high version number characteristic of dependency-confusion attacks against private internal package names. package.json declares a postinstall hook that runs callback.js, which auto-executes on npm install. callback.js requires os, https, http, and child_process, then calls collectSystemInfo() to gather os.userInfo, os.hostname, uid/gid, homedir, platform, cwd, local IP, and external IP (via https.get to api.ipify.org). It reads CI/CD credential environment variables including AWS_ACCESS_KEY_ID, GITHUB_TOKEN, NPM_TOKEN, DOCKER_PASSWORD, GITHUB_REPOSITORY, and GITHUB_ACTOR, and includes their values or presence flags in a JSON payload. The payload is POSTed to a hardcoded Discord webhook at discord.com/api/webhooks/1549797176794943579/..., with an additional DNS-based exfil channel. The package's self-labeling as an 'authorized PoC' is author-controlled cover-story text and does not change the observed behavior: any organization that resolves this name from the public registry will run installer-side reconnaissance and ship credential-context data to an attacker-controlled endpoint.
Source: ossf-package-analysis (59d074c4d6bd941d9586764043d556a83d301711c58eb661d57d63fa06ebec60)
The OpenSSF Package Analysis project identified 'idx_form_script' @ 999.0.4 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.