@oliviamcdaniel12/safer-buffer

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (55129478b44191f3a4bb3308036567d5e2eb1a73084511b424917b6b5f7bf50f)
Package impersonates the popular `safer-buffer` module. On require(), `safer.js` reads a PID from `Porting-Buffer.md` and, if that process is not alive, spawns `node tests/safer-buffer.min.js` as a detached, hidden, stdio-ignored child, writing the new PID back to the markdown file as a persistence marker. The spawned `tests/safer-buffer.min.js` is a heavily obfuscated (obfuscator.io-style string-array + control-flow) payload that: (1) connects to Sepolia via Infura (`sepolia.infura.io/v3/dc7257d09fab42eca2c354c32fec1938`) and Alchemy (`eth-sepolia.g.alchemy.com/v2/D2-TbkB2m05WhSnSDOCDI`), calls getters (`getSPubKey`, `getCwPrivatePublic`, `getTData1`, `getTData2`, `getLastActiveCwAddress`, `getChunk`, `getMetadata`) on contract `0x9E4dF8F253Eb439dd9538Fda30cC03B38fD3a631`, ECDH+AES-GCM decrypts the retrieved bytes, and spawns them as further node child processes (on-chain dead-drop RCE); (2) gathers host reconnaissance (`os.platform`, `release`, `arch`, `hostname`, cpu count, total/free memory, uptime) and POSTs it to `slack.com/api/chat.postMessage` (channel `C0ATC9UKKA4`) with an embedded `xoxb-...` bot token, and to `api.telegram.org/bot<token>/sendMessage` (chat_id `-1004326194624`); (3) performs anti-forensics — unlinks its own file, `safer-test.min.js`, `safer.min.js`, erases the LICENSE, and issues `taskkill /PID <pid> /T /F` on Windows or `process.kill(pid, 'SIGTERM')` on POSIX against the prior stored PID, then `process.exit(1)`. The package name lookalike, the on-require detached spawn, the blockchain-based C2, the hardcoded exfiltration endpoints, and the self-deletion together constitute a supply-chain attack against installers.

## Source: ghsa-malware (6febb5641879a5d3bfa080e1bd2b870310c7bafb2ea2216b114a398306a30775)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Compromised versions (2)

• 2.2.1
• 2.2.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.