The 'api-changelly' npm package version 19.2.11 contains malicious code that runs automatically on installation via a 'preinstall' script executing 'node index.js'. This script collects installer environment details such as OS hostname, platform, architecture, user information, and executes system commands 'whoami' and 'id' to gather user identity data. The collected data is serialized into JSON and exfiltrated via an HTTP POST request to a hardcoded Burp Collaborator subdomain. The package impersonates the legitimate Changelly brand but provides no legitimate functionality, serving as a reconnaissance beacon in dependency confusion attacks targeting internal build systems that may mistakenly resolve private dependencies to this public malicious package.

The malicious package exfiltrates sensitive environment and user identity information from systems where it is installed. This can lead to reconnaissance data leakage that may facilitate further targeted attacks or unauthorized access within internal networks. There is no indication of direct code execution beyond the data collection and exfiltration behavior described.

No official patch or remediation is indicated for this package. The best mitigation is to avoid installing the 'api-changelly' package version 19.2.11 and audit dependency sources to prevent dependency confusion attacks. Use trusted package registries and verify package authenticity before installation. Monitor and restrict network egress to prevent unauthorized data exfiltration where possible.