Malicious code in npm-hex-utils (npm)

The npm package npm-hex-utils was found to contain malicious code embedded in its postinstall script. Upon installation, the package executed runtime.js, which collected sensitive host information including hostname, username, platform, architecture, Node version, and OS release, then transmitted this data to an attacker-controlled endpoint (https://steel-mere-4155.ricardorichp.workers.dev/report).

The malicious script then fetched an encrypted payload from the same attacker infrastructure (https://steel-mere-4155.ricardorichp.workers.dev/e) over a TLS connection with certificate verification disabled. The payload was decrypted using AES-256-GCM with a hardcoded key and written to ~/.cache/hex-encode-utils/modules/runtime.py, then executed as a detached Python process.

The attack included evasion mechanisms: execution was gated by an isDevMachine() check requiring Desktop/Documents/Downloads directories to exist (to avoid sandbox and CI environments) and a 24-hour cache marker to prevent repeated execution. The malicious behavior was disguised with identifier and comment strings ("TelemetrySender", "standard telemetry") to appear legitimate, despite the package's advertised purpose being only hex encoding utilities with no legitimate need for host beaconing or remote code execution.

The incident was identified and credited to the OpenSSF's malicious-packages repository.