GHSA-h5wr-6cx4-x5v4: Malicious code in ssite-mock-server (npm)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected Software
Event History
Frequently Asked Questions
What systems should be treated as exposed?
Any computer where the package was installed or run should be treated as fully compromised. This includes developer workstations, build agents, and CI environments that installed it.
Does installation alone trigger the malicious activity?
Yes. Its postinstall script runs node ./index.cjs during npm installation, so execution can occur as part of npm install.
What information does the package send out?
The postinstall script POSTs the hostname, home directory, platform, and detected CI provider to 130.162.231.177 on port 8443. The CI providers specifically identified are GitHub Actions, GitLab CI, Azure Pipelines, and Jenkins.
What should be done if the package was installed?
Rotate all secrets and keys stored on the affected computer immediately, using a different computer. Remove the package, but do not assume removal eliminates the compromise because additional malicious software may have been installed.