The 'conversionvaluemanager' npm package version 3.0.0 includes a postinstall script that automatically runs upon installation. This script gathers installer environment details such as hostname, user info, platform, current working directory, Node.js version, and timestamp. It then sends these details as query parameters over plain HTTP to a Burp Collaborator domain controlled by a third party. The package is designed as a proof-of-concept for dependency confusion attacks and targets internal/private package names. Any organization whose build system mistakenly resolves this public package instead of an internal one will leak sensitive environment information to the external server during installation.

Installation of the affected package version results in leakage of host and environment identifiers to an external third-party server. This can expose sensitive information about the build environment, potentially aiding attackers in reconnaissance. The leakage occurs silently on every install via unencrypted HTTP requests. There is no indication of further malicious payloads or exploitation beyond data exfiltration.

No official patch or fix is currently available for this package version. Users should avoid installing or resolving the 'conversionvaluemanager' package version 3.0.0 from public npm registries, especially in environments where internal package names could be confused. Review and enforce strict package resolution policies to prevent dependency confusion. Monitor package dependencies for suspicious or unexpected packages and remove or replace this package if found.