The malicious library-explorer package (npm ecosystem) version 25.2.1 includes a preinstall script that runs automatically on npm install. This script gathers extensive system and user identity information (hostname, platform, architecture, home directory, user info including username, uid, gid, shell, CPU, memory) and executes system commands ('whoami' and 'id' on non-Windows systems). It then sends this aggregated data as JSON to a hardcoded Burp Collaborator domain (https://bgvge0daqrvkonl6x9qrx553ruxllb90.oastify.com/detox56). The package lacks legitimate functionality and is consistent with a staged beacon for dependency confusion or internal reconnaissance.

Installation of the affected package version results in unauthorized collection and exfiltration of sensitive system and user identity information to an external attacker-controlled server. This compromises host privacy and may facilitate further targeted attacks or reconnaissance. No direct code execution beyond the preinstall script is indicated, and no known exploits in the wild have been reported.

No official patch or remediation is currently available. Users should avoid installing library-explorer version 25.2.1. Verify package authenticity before installation and consider using package integrity verification or trusted registries. Monitor for updates or vendor advisories for remediation guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.