The malicious npm package [email protected] uses a postinstall hook to execute index.js automatically when installed. This script gathers sensitive environment information including the OS username, current working directory, and external IPv4 address, and exfiltrates this data via a POST request to a hardcoded out-of-band collector URL (dodwqvexnkotaavogofbj9kjz5pltcu7b.oast.fun/receive-data). The package name is crafted to impersonate MercadoLibre's internal 'fury/andes-ui' package, leveraging a dependency confusion attack by publishing a high version number (99.9.5) to override legitimate internal dependencies. The package contains no functional code beyond this data collection and exfiltration.

Installation of this package results in unintended disclosure of environment-specific information such as the OS username, current working directory, and external IP address to an attacker-controlled server. This can aid attackers in reconnaissance and further targeted attacks. No direct code execution beyond the postinstall script is indicated, and no additional functionality is provided by the package.

No official patch or remediation is indicated. Users should avoid installing the package [email protected] from untrusted sources. Verify package provenance and use scoped or internal registries to prevent dependency confusion attacks. Monitor dependency manifests for suspicious high-version packages mimicking internal names. Since this is a malicious package published to a public registry, removing or blocking this package from installation is recommended.