Malicious code in @oliviamcdaniel12/safer-buffer (npm)
Source: amazon-inspector
Package impersonates the popular safer-buffer module. On require(), safer.js reads a PID from Porting-Buffer.md and, if that process is not alive, spawns node tests/safer-buffer.min.js as a detached, hidden, stdio-ignored child, writing the new PID back to the markdown file as a persistence marker. The spawned tests/safer-buffer.min.js is a heavily obfuscated (obfuscator.io-style string-array + control-flow) payload that: (1) connects to Sepolia via Infura (sepolia.infura.io/v3/dc7257d09fab42eca2c354c32fec1938) and Alchemy (eth-sepolia.g.alchemy.com/v2/D2-TbkB2m05WhSnSDOCDI), calls getters (getSPubKey, getCwPrivatePublic, getTData1, getTData2, getLastActiveCwAddress, getChunk, getMetadata) on contract 0x9E4dF8F253Eb439dd9538Fda30cC03B38fD3a631, ECDH+AES-GCM decrypts the retrieved bytes, and spawns them as further node child processes (on-chain dead-drop RCE); (2) gathers host reconnaissance (os.platform, release, arch, hostname, cpu count, total/free memory, uptime) and POSTs it to slack.com/api/chat.postMessage (channel C0ATC9UKKA4) with an embedded xoxb-... bot token, and to api.telegram.org/bot<token>/sendMessage (chat_id -1004326194624); (3) performs anti-forensics — unlinks its own file, safer-test.min.js, safer.min.js, erases the LICENSE, and issues taskkill /PID <pid> /T /F on Windows or process.kill(pid, 'SIGTERM') on POSIX against the prior stored PID, then process.exit(1). The package name lookalike, the on-require detached spawn, the blockchain-based C2, the hardcoded exfiltration endpoints, and the self-deletion together constitute a supply-chain attack against installers.
Source: ghsa-malware
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
