Malicious code in hex-encode-utils (npm)

The npm package hex-encode-utils was compromised with malicious code embedded in a postinstall hook (scripts/compat.js). Upon installation, the hook fetches an AES-256-GCM-encrypted blob from two hardcoded Cloudflare Workers domains (steel-mere-4155.ricardorichp.workers.dev and cold-peak-7969.0x0gnx0.workers.dev) with TLS verification disabled, decrypts it using a hardcoded key derived from a 'BIP-0174' string, and writes the plaintext to ~/.cache/hex-encode-utils/modules/exec_runtime.py.\n\nBefore executing the payload, the script sends a POST beacon to the same Workers host containing the installer's hostname, username, platform/architecture, Node version, and package version, formatted as an HTML Telegram message with chat_id 6087129674 for relay to an attacker-controlled Telegram bot. The malicious behavior is gated by sandbox-evasion checks that skip execution in CI/container environments (CI, GITHUB_ACTIONS, DOCKER_CONTAINER, KUBERNETES_SERVICE_HOST) and require the presence of Desktop/Documents/Downloads directories under $HOME to confirm a developer workstation.\n\nThe package's legitimate purpose (hex encode/decode) has no legitimate need for postinstall network I/O, encrypted-payload fetching, Python execution, or host reconnaissance. The code is disguised with comments framing it as a next.js/nuxt-style compatibility shim. The incident was discovered and reported by OpenSSF researchers via Amazon Inspector.