The chat-adapter-zoom npm package was published by an attacker as part of a dependency confusion campaign targeting organizations using private Zoom chat-adapter integration packages. The malicious package includes a preinstall script that runs before application code, installing @sentry/node and executing a script that collects host telemetry such as public IP, hostname, OS username, and runtime metadata. This data is sent to a hardcoded attacker-controlled Sentry DSN, allowing the attacker to identify which organizations installed the package. Each package in the campaign uses a distinct Sentry project ID for attribution. The payload is identical across packages except for the package name and Sentry project ID. No official patch or fix is indicated in the provided data.

The malicious package can exfiltrate sensitive host telemetry and environment information during installation, potentially exposing organizational infrastructure details to attackers. This reconnaissance data can be used to identify and target specific organizations that inadvertently install the malicious package due to dependency confusion. There is no indication of further exploitation beyond data exfiltration during install time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or advisory is available, users should audit and verify package sources carefully, avoid installing packages with suspicious or unexpected names, and ensure private package namespaces are correctly configured to prevent dependency confusion. Consider using package integrity verification and scoped registries to reduce risk.