The @iana-rzms/bff-sdk npm package version 1.0.0 is a malicious package published publicly as a dependency-confusion squat targeting an internal ICANN namespace. Upon installation, its preinstall lifecycle script runs automatically and collects sensitive environment information including hostname, OS username, and current working directory. This information is base64-encoded and exfiltrated to a hardcoded external domain controlled by an attacker via multiple protocols (HTTPS, HTTP, DNS). Despite the README claiming an 'authorized PoC,' the package executes attacker-controlled code on the installer's machine, causing a security breach through data leakage and unauthorized code execution.

Installation of this package results in execution of attacker-controlled code on the victim's machine during the npm install process. Sensitive environment information (hostname, OS username, current working directory) is exfiltrated to an external server, potentially compromising user privacy and security. This can lead to further targeted attacks or reconnaissance by adversaries. There is no indication of exploitation in the wild yet.

Avoid installing the @iana-rzms/bff-sdk package version 1.0.0 from the public npm registry. Since no patch or fix is available, users should remove this package from their dependencies and verify their build processes to prevent dependency confusion attacks. Monitor for any unexpected network activity related to the described external domain. Check vendor or registry advisories for updates or removal of the malicious package.