The rtc-integration-frontend-sdk npm package at version 99.9.0 includes a postinstall lifecycle hook that runs automatically upon npm install. The hook executes a script (index.js) that gathers detailed reconnaissance data from the host environment, including OS hostname, user information, platform architecture, local network addresses, public IP address via an external API, current working directory, and the package name. This collected information is exfiltrated via an HTTP POST request to a hardcoded Discord webhook URL at discord.com/api/webhooks/, which is attacker-controlled. The package name and version suggest it is a malicious typosquat or version-bump lure intended to trick users into installing it and thereby leaking sensitive host data during installation.

Installing rtc-integration-frontend-sdk version 99.9.0 results in automatic exfiltration of sensitive host environment information to an attacker-controlled endpoint. This compromises host privacy and may facilitate further targeted attacks or reconnaissance by adversaries. There is no indication of remote code execution or persistence beyond the install-time data leak. No known exploits in the wild have been reported.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing rtc-integration-frontend-sdk version 99.9.0. Verify package authenticity before installation and use trusted sources. Remove any installations of this version if present. Monitor package dependencies for typosquatting or suspicious versions. Patch status is not yet confirmed — check vendor or repository advisories for updates.