The google-caja-bower npm package version 1000.801.20 (and several other exact versions) includes a preinstall script that runs index.js automatically during npm install. This script enumerates up to 500 files (excluding common binary/media types) up to 8MB each from the current working directory and uploads their contents along with system metadata (hostname, user environment variables, platform, current directory) to two hardcoded Discord webhook URLs. The files uploaded may include sensitive credential files such as .env, .npmrc, SSH configs, and cloud credentials. The package name mimics the Google Caja/Bower namespace and self-describes its behavior as a 'Dependency Confusion Crawler,' indicating intentional malicious data exfiltration.

Sensitive information including environment variables, configuration files, and source code can be exfiltrated from the installer's system to an attacker-controlled endpoint. This can lead to credential compromise, unauthorized access, and further exploitation of affected systems. The automatic execution on install increases the risk of widespread impact if the package is used in development or deployment pipelines.

No official patch or remediation is currently documented. Users should avoid installing the google-caja-bower package in any version listed. Verify package authenticity before installation and prefer official, verified packages from trusted sources. Monitor for and remove any instances of this package from projects and dependency trees. Since this is not a cloud service, remediation depends on user action to remove or block the malicious package.