[email protected] is a malicious package designed to exploit dependency confusion by masquerading as a legitimate package. Upon installation, its postinstall.js script runs automatically and issues an HTTPS request to a hardcoded Burp Collaborator subdomain, exfiltrating the installer's OS hostname in the query string. This behavior leaks host identity information to an attacker-controlled out-of-band domain without user consent.

The impact is limited to the exfiltration of the installer's OS hostname to an attacker-controlled server during package installation. This can lead to information disclosure about the host environment. There is no indication of further malicious activity or code execution beyond this data exfiltration.

No official patch or remediation is currently available for this malicious package. Users should avoid installing [email protected] and verify package authenticity before installation. Since this is a malicious package published on npm, removing or blocking this package from dependency trees is recommended. Monitor vendor advisories for any updates.