The fkext-browser-min npm package version 1.0.14 executes a malicious preinstall lifecycle script named vishu.js. This script gathers sensitive environment information including the machine's public IP address, hostname, and CI environment variables (GITHUB_*). It transmits this data over HTTPS to a hardcoded webhook.site URL and performs a DNS lookup to a subdomain under oastify.com, enabling out-of-band data exfiltration that can bypass HTTP egress filters. The package does not provide any legitimate functionality and serves as a beacon for attacker reconnaissance in installer or CI environments.

The malicious preinstall script can leak sensitive environment information such as public IP, hostname, and CI environment variables to an attacker-controlled server. This can lead to reconnaissance of the victim environment and potentially aid further targeted attacks. The out-of-band DNS exfiltration channel can bypass network egress restrictions, increasing the risk of undetected data leakage. There is no indication of direct code execution beyond the preinstall script or persistence beyond installation.

No official patch or remediation is currently documented. Users should avoid installing fkext-browser-min version 1.0.14. Verify package integrity and source before installation, and consider removing or replacing this dependency. Monitor for updates from the package maintainer or npm advisories for any official fixes. Since this is not a cloud service, remediation depends on user action.