The '@leviosa86com/leviosa86-test' npm package in specified versions contains a malicious payload in 'src/poc/index.js' that executes system commands to gather host information (hostname, current directory, user identity) and the public IP address. It then constructs a unique subdomain and performs a DNS lookup to an attacker-controlled OAST server, effectively exfiltrating reconnaissance data out-of-band. The package.json defines a 'preinstall' script to run this code during installation, although the root index.js is missing, possibly limiting some execution paths. The package's high version numbers and naming suggest a deliberate attempt at namespace squatting or dependency confusion to trick users into installing it.

The malicious package can leak sensitive host environment information and the installer's public IP address to an attacker via DNS queries. This reconnaissance data could aid attackers in further targeted attacks or exploitation. There is no indication of remote code execution beyond the install-time script or persistence mechanisms. No known exploits in the wild have been reported.

No official patch or fix is available for this malicious package. The best mitigation is to avoid installing or using '@leviosa86com/leviosa86-test' versions 4.999.0, 5.999.0, 6.0.0, and 6.2.1. Verify package authenticity before installation, especially for packages in private scopes or with suspicious versioning. Use trusted sources and consider implementing supply chain security controls such as package signing and dependency auditing. Monitor for and remove any installations of this package in your environment.