The polipoli-pak package versions 1.0.1 and 1.0.2 include a postinstall.js script that runs automatically on npm install. This script performs two unauthorized actions: it sends a JSON fingerprint of the installer's environment—including hostname, username, platform, architecture, Node.js version, current working directory, npm user-agent, and environment variable names—to a hardcoded webhook.site URL. It also searches for common index.html files in the project directory and overwrites them to inject a fixed-position red banner div into the page body. This behavior exposes sensitive environment information and modifies user project files without consent.

The unauthorized exfiltration of environment details can reveal sensitive information about the host system and credentials present in environment variables. The silent modification of HTML files can disrupt project integrity and introduce unwanted visual elements, potentially impacting application behavior or user trust. Although no known exploits in the wild are reported, the presence of this malicious code poses a significant risk to confidentiality and integrity of the affected projects.

No official patch or remediation is currently documented. Users should avoid installing polipoli-pak versions 1.0.1 and 1.0.2. Review and remove these versions from projects if present. Monitor for updates or advisories from the package maintainers or npm registry. Since this is not a cloud service, remediation depends on user action to uninstall or replace the malicious package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.