The @meziizana/frontend-logger package version 10.0.0 declares a preinstall lifecycle script in its package.json that automatically runs on npm install. This script uses wget to send sensitive environment information—specifically the installer's username, working directory, and hostname—to a public webhook.site URL. This behavior constitutes malicious code execution and unauthorized data exfiltration, as the webhook.site endpoint is not part of any legitimate build or install process and is known to be abused for such purposes.

Installation of version 10.0.0 of @meziizana/frontend-logger results in unauthorized disclosure of environment information (username, working directory, hostname) to a third-party endpoint. This can lead to privacy violations and reconnaissance that may facilitate further targeted attacks. There is no indication of remote code execution or other direct system compromise beyond this data leakage.

Avoid installing version 10.0.0 of @meziizana/frontend-logger. Since no patch or remediation is currently available, users should remove this package from their dependency tree and replace it with a trusted alternative. Monitor for updates from the package maintainer or npm advisories for any official fixes or removals. Do not run npm install commands that include this package until it is confirmed safe.