The guest-app-ui package published on npm as version 99.0.0 is a malicious artifact designed to exploit dependency confusion by using an unclaimed internal package name. Its installation scripts (preinstall and postinstall lifecycle hooks) execute a callback that collects detailed host fingerprinting information including hostname, user environment variables, directory paths, platform and network details. This information is base64url-encoded and exfiltrated to a hardcoded external host via three redundant channels: DNS subdomain queries, HTTP POST, and HTTPS POST with disabled TLS verification. This unconditional data exfiltration occurs on every installation of this package version, posing a privacy and security risk to affected systems.

Hosts that install guest-app-ui version 99.0.0 will have sensitive system and environment information collected and transmitted to an external attacker-controlled server. This can lead to exposure of internal network details and user environment data, potentially facilitating further targeted attacks or reconnaissance. The malicious package exploits dependency confusion, increasing the risk of inadvertent installation in organizations using private registries without strict package scoping or pinning.

No official patch or fix is currently available for this malicious package version. Organizations should audit their package dependencies and private registries to ensure that no unscoped or unpinned references to guest-app-ui exist that could cause this malicious version to be installed. Avoid installing or updating to guest-app-ui version 99.0.0 from public npm registries. Implement strict package scoping and registry pinning to prevent dependency confusion attacks. Monitor and block network communications to the identified malicious host 4li9yfz7.instances.httpworkbench.com.