The uac-package versions 1.4.1, 1.4.3, 1.4.5, 1.4.6, and 1.4.7 execute a postinstall script that modifies the installer's source tree by patching package.json scripts, injecting imports, and adding plugins/modules to build configurations. The injected tracker code enumerates localStorage and sessionStorage for authentication tokens from many identity providers, decodes JWT payloads, scans authentication cookies, monkey-patches network request methods to intercept authentication responses, and listens to form input events to capture user data and purchase details. All collected data is sent to a hardcoded third-party URL without any consent mechanism, effectively creating a covert identity and input data exfiltration channel embedded in the final application.

This malicious behavior exposes sensitive authentication tokens, session cookies, and user input data from the affected applications to an unauthorized external endpoint. This can lead to user account compromise, session hijacking, and leakage of sensitive personal and transactional information. The compromise occurs silently during installation and persists in the shipped application, impacting end users' security and privacy.

No official patch or remediation is currently documented. Users should avoid using the affected versions of uac-package (1.4.1, 1.4.3, 1.4.5, 1.4.6, 1.4.7). Review and remove this package from your projects and replace it with trusted alternatives. Monitor your applications for unauthorized code modifications and network traffic to unknown endpoints. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.