@car_loans/dealerships-approval 7.1.5 is a malicious npm package that disguises itself as a browserslist config but includes an obfuscated postinstall script. This script downloads a remote payload in base64 fragments, decrypts it using RC4, writes it to disk with executable permissions, and runs it detached from the install process. It collects system information such as hostname, username, platform, architecture, package name/version, and an event tag, then exfiltrates this data via HTTP POST to a remote host. Additionally, it uses DNS resolution calls with encoded fingerprint data as a covert DNS tunnel to bypass HTTP egress filtering. The package also uses dependency confusion by presenting itself as an internal package with a fake scope and instructing users to point npm configuration to a non-existent domain, enabling attackers to trigger install-time code execution and data theft on targeted organizations.

This malicious package enables attackers to execute arbitrary code on the installer's machine without user interaction during npm install. It also collects and exfiltrates sensitive host fingerprinting information, potentially compromising the security and privacy of the affected system. The use of DNS tunneling for data exfiltration may evade traditional network monitoring and filtering controls. The dependency confusion technique increases the risk of inadvertent installation in targeted environments, leading to immediate compromise.

No official patch or remediation is currently available for this malicious package. Users and organizations should avoid installing @car_loans/dealerships-approval version 7.1.5 and any packages from the suspicious @car_loans scope. Review and restrict npm registry sources to trusted repositories only. Monitor for and remove any instances of this package from development and production environments. Since this is a malicious package published to the public npm registry, consider reporting it to npm security teams for takedown and further investigation. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.