The npm package 'npm-rce-safe-proof-yourname' version 1.0.0 includes a postinstall.js script that runs automatically on installation. This script executes the 'whoami' command, reads system information such as hostname, platform, and Node.js version, and transmits these details to a hardcoded external endpoint (https://testnpm.byte.eyes.sh/npm-proof). This unauthorized data transmission acts as an install-time beacon leaking the installer's identity and system details, representing a privacy and credential leakage vulnerability. The package's stated function as a script for showing date strings is inconsistent with this behavior.

This vulnerability leads to unauthorized disclosure of the installer's username, hostname, operating system platform, and Node.js version to a remote attacker-controlled server. Such leakage can compromise user privacy and potentially aid attackers in profiling or targeting affected systems. There is no indication of further exploitation beyond this data exfiltration.

No official patch or remediation is currently available for this package version. Users should avoid installing 'npm-rce-safe-proof-yourname' version 1.0.0. Review and audit npm packages before installation, especially those with unexpected lifecycle scripts. Monitor for updates or advisories from the package maintainer or npm registry regarding this issue.