The es6-codify package, advertised as a small ES6 utility library, includes malicious code in its entrypoints (dist/index.cjs and the ESM build) that performs an HTTPS POST request to a hardcoded attacker-controlled host. This request transmits a JSON payload containing the full process environment variables, current working directory, Node.js version, and command-line arguments. The exfiltration triggers immediately upon module import or require, regardless of the module system used. There is no legitimate network functionality in the package, confirming the network activity is unauthorized data exfiltration.

Sensitive environment variables and runtime information are leaked to an attacker-controlled server whenever the package is loaded. This can lead to compromise of secrets such as cloud credentials, tokens, and database URLs, potentially enabling further attacks on the victim's infrastructure or data.

No official patch or remediation is currently documented. Users should immediately remove and replace the es6-codify package from their projects. Avoid using this package and audit dependencies for malicious code. Monitor for any unauthorized access using leaked credentials. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.