The malicious npm package @broadpeak/[email protected] declares a preinstall script that runs automatically on npm install. This script executes system commands (whoami, id), collects host identifiers such as hostname, platform, architecture, user info, and current working directory, then sends this data as JSON to a hardcoded Burp Collaborator OAST endpoint controlled by an attacker. The package lacks functional code and legitimate metadata, consistent with reconnaissance for dependency confusion attacks. This confirms arbitrary code execution during installation and leaks sensitive environment information to the attacker.

Installation of this package leads to unauthorized execution of code on the installer's system, resulting in leakage of sensitive host and user environment information to an attacker-controlled external endpoint. This compromises confidentiality of the build environment and confirms the ability of the attacker to execute code within that environment, potentially enabling further targeted attacks.

No official patch or remediation is currently available. Users should avoid installing the @broadpeak/smartlib-ad package version 24.1.10. Verify package authenticity before installation, especially for packages scoped to internal or private namespaces. Monitor for and remove any instances of this package in build environments. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.