exodus-firestore-synchronize

Details

**Severity:** Critical

**Affected versions:** `= 0.0.1`

## Source: amazon-inspector (210b71fe2403143719408cea9a34626d7788c9aaa87b3f5a1276a92bd5578ce6)
package.json declares a postinstall hook that auto-runs on `npm install` and executes `whoami` and `hostname`, then enumerates `process.env` for keys matching /TOKEN|SECRET|KEY|AUTH|npm/i and prints the matches to stdout. The package name and description impersonate an internal 'Exodus Wallet SDK' and self-identify as a dependency-confusion demonstrator published to the public registry to intercept installers that misroute an internal package name to this public one. No outbound network sink is present in this version, so the enumerated environment values and host identifiers are written only to the install log rather than transmitted; however, on CI systems those install logs are frequently captured, archived, or exposed, and the enumeration itself targets credential-shaped environment variables.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/2bb9370d891283643f919e860abea2cc197b0b3b/osv/malicious/npm/exodus-firestore-synchronize/MAL-2026-16533.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/2bb9370d891283643f919e860abea2cc197b0b3b/osv/malicious/npm/exodus-firestore-synchronize/MAL-2026-16533.json
- https://www.npmjs.com/package/exodus-firestore-synchronize/v/0.0.1
- https://github.com/advisories/GHSA-m497-v5g4-6c4q

Compromised versions (1)

• = 0.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.