The 'vuln-package' npm package versions 99.9.9, 99.9.10, 99.9.11, and 99.9.14 include a preinstall script that triggers an out-of-band DNS lookup to a unique oast.fun subdomain, confirming execution on the target system. Concurrently, a related script collects sensitive host environment information (os.userInfo().username, os.hostname(), process.cwd(), and environment variables) and sends it via HTTPS POST to a hardcoded webhook.site URL. This combination of OOB DNS beaconing and staged HTTPS exfiltration is characteristic of a supply-chain reconnaissance and data exfiltration attack, indicating malicious intent embedded in the package's installation process.

Successful installation of the affected package versions results in unauthorized code execution on the installer's machine, leading to the exfiltration of sensitive host identifiers and environment information to a third-party attacker-controlled endpoint. This compromises the confidentiality of the host environment and may facilitate further targeted attacks or reconnaissance.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing the affected versions (=99.9.9, =99.9.10, =99.9.11, =99.9.14) of 'vuln-package'. Remove any existing installations of these versions and monitor for suspicious network activity related to oast.fun or webhook.site domains. Check for vendor advisories or trusted sources for updates or official remediation guidance.