The npm package [email protected] registers preinstall and postinstall lifecycle hooks that execute index.js, which collects various machine identifiers (os.hostname(), os.userInfo().username, os.homedir(), dns.getServers(), current working directory, and full package.json) and exfiltrates them to an external Interactsh-style domain 'bvfmpadujgjgmbtzeibiikzijuhmtd2rs.oast.fun' via HTTPS POST and DNS lookup. The package name pattern and description indicate it is a dependency-confusion probe targeting internal/private package names. This results in automatic leakage of sensitive internal environment information on npm install without user interaction.

Sensitive internal information including hostnames, usernames, home directories, DNS server configurations, and full package metadata can be exfiltrated to an external attacker-controlled domain. This leakage can expose internal network details and user environment data, potentially aiding further targeted attacks or reconnaissance. The compromise occurs automatically during package installation without user consent or awareness.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing [email protected] and audit dependencies for suspicious or unexpected packages, especially those matching internal or private naming patterns. Implement strict package source verification and consider using package allowlists or internal registries to prevent dependency confusion attacks. Monitor for and remove this package if found in existing environments.