The malicious npm package 'react-dom-v17' (version 15.0.1) uses a preinstall script declared in its package.json to execute 'node index.js' automatically during installation. This script runs shell commands ('whoami' and 'id') to collect user and system information, gathers additional environment details via Node.js APIs, and sends this information as a JSON payload to a hardcoded attacker-controlled domain (oastify.com). The execution of arbitrary shell commands during installation provides an attack surface for further malicious payloads. This package impersonates the widely-used 'react-dom' package to deceive users into installing it.

Installation of this malicious package results in unauthorized collection and exfiltration of sensitive host and user information to an attacker-controlled server. Additionally, the arbitrary command execution capability during installation can lead to further compromise of the installing system. This poses a significant risk to confidentiality and system integrity for users who install this package.

No official patch or remediation is currently available. Users should avoid installing the 'react-dom-v17' package, especially version 15.0.1, as it is malicious. Verify package authenticity by using official package sources and names. Monitor package dependencies for suspicious or impersonating packages. Patch status is not yet confirmed — check the vendor advisory or trusted sources for current remediation guidance.