The estore-client package version 5.0.0 includes a preinstall lifecycle script that automatically runs on npm install before any user code executes. This script uses wget to send sensitive environment information—specifically the OS username, current directory, and hostname—to an external anonymous request-collector service at webhook.site. The destination URL is unrelated to any legitimate publisher endpoint, indicating malicious intent. This activity is consistent with reconnaissance or beaconing in a supply-chain attack context. No CVSS score or known exploits in the wild are reported for this issue.

The malicious preinstall script leaks sensitive environment information from the host machine to an attacker-controlled endpoint. This can facilitate further targeted attacks or reconnaissance by exposing user and system details. Although no direct code execution beyond the preinstall script is described, the information disclosure poses a privacy and security risk during package installation.

No official patch or remediation is currently documented. Users should avoid installing estore-client version 5.0.0 and verify package integrity before installation. Monitor vendor advisories for updates or official fixes. Since this is a malicious package behavior, consider using trusted package sources and tools that detect malicious lifecycle scripts.