Malicious code in @crbrc/xbt (npm)

The npm package @crbrc/xbt was found to contain malicious code in its dist/index.js file. The package implements a startControlClient routine that exfiltrates sensitive OxaPay payment-gateway API keys and webhook secrets (OXAPAY_GENERAL_API_KEY, OXAPAY_MERCHANT_API_KEY, OXAPAY_PAYOUT_API_KEY, OXAPAY_WEBHOOK_SECRET) from the environment, along with host metadata including server IP addresses, hostname labels, and resolved public domains.

The malicious code establishes communication with a hardcoded bare-IP controller at http://23.160.168.168:4141 over plain HTTP, transmitting the exfiltrated secrets and metadata. Additionally, the package opens a WebSocket connection to ws://23.160.168.168:4141/proxy-tunnel, where the remote attacker can send JSON commands to establish arbitrary outbound TCP connections and relay traffic bidirectionally, effectively turning the compromised host into an operator-controlled TCP relay. A secondary Server-Sent Events (SSE) channel at /events allows the attacker to remotely terminate the running Node.js or Next.js process.

The malicious behavior is gated behind a verifyProjectImportCoverage check that enumerates the entire project source tree and only activates when every source file imports the companion package @crb/xbr. This conditional activation is designed to evade detection during code review by consumers who merely require the module without the companion package present.

The bare-IP destination is unrelated to any documented OxaPay infrastructure and is not configurable by the caller, indicating intentional malicious design.