The consumerweb npm package version 2200.4.2 executes malicious code during installation lifecycle hooks (preinstall and postinstall). This code gathers host reconnaissance data including os.hostname(), os.userInfo().username, os.homedir(), current working directory, DNS server information, and package metadata. The data is exfiltrated through DNS queries and HTTPS POST requests to a subdomain of oast.fun, an attacker-controlled OAST collaborator domain. The package name and description suggest it is designed to exploit dependency confusion by squatting on an internal package name, confirming its existence and leaking identifying environment information. There is no legitimate reason for this data collection or exfiltration, and the installer is not prompted for consent.

Successful installation of this malicious package results in unauthorized disclosure of sensitive environment information, including host identifiers and network configuration details. This leakage can aid attackers in further targeting or reconnaissance of the affected environment. The attack confirms internal package names via dependency confusion, potentially facilitating supply chain attacks. There is no indication of direct code execution beyond the installation hooks or further payloads, but the information leak itself poses a privacy and security risk.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing consumerweb version 2200.4.2 from untrusted sources. Verify package authenticity and source before installation, and consider using package allowlists or internal registries to prevent dependency confusion attacks. Monitor for suspicious package names that mimic internal dependencies. Patch status is not yet confirmed — check the vendor or package repository advisory for current remediation guidance.