Critical RCE in dal-shiluse-context-selector via compromised npm postinstall script

Vulnerability Overview Title: Malicious Code Execution via Compromised Commit Description: Between T0 and T1, the default branch contained malicious commits that executed attacker-controlled code on developer machines. The commits were removed via force push; however, local clones, forks, and direct SHA URLs may still contain them, and against the affected checkout will still execute the code. This package was not published to npm. Severity: Critical. Arbitrary RCE as the user running . Scope Package: Affected Versions: - - - - Fixed Versions: None Remediation 1. Treat machines as compromised: A full OS reinstall is the only reliable remediation. 2. Rotate every credential accessible from each machine: Including GitHub PATs/OAuth/SSH keys, npm and other registry tokens, cloud credentials, browser sessions and saved passwords, crypto wallets, and files. 3. Audit account activity: From T0 commit, published packages, deployments, cloud API calls, and financial transactions. 4. Clean local clones: Re-clone or hard reset to a commit before T0. Code Behavior was added and linked to the script. It fetches a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via environment variables). TLS verification is disabled, and the response is evaluated as code using when available. CI and cloud serverless environments were intentionally skipped, targeting developer workstations. The second-stage payload is hosted by the attacker and cannot be reconstructed. It is assumed that the Node process has access to everything, operating with user privileges. Indicators of Compromise (IOCs) Presence of and its reference in within in the affected commits. Unexpected outbound HTTPS from developer machines running to the affected commit or any subsequent commits. Specific domain names and environment variable names will be added upon confirmation. Root Cause The maintainer's development machine was compromised, allowing the attacker access to the maintainer's GitHub credentials. The machine has been reinstalled, and all GitHub and npm credentials have been rotated.

Goal Reached Thanks to every supporter — we hit 100%!

Critical RCE in dal-shiluse-context-selector via compromised npm postinstall script

More from this source