The [email protected] npm package includes a malicious script (src/poc/index.js) that uses child_process.exec to run shell commands gathering system information such as hostname, current directory, user identity, package identifier, and the public egress IP. The collected data is concatenated and exfiltrated via DNS queries (nslookup) to an Interactsh out-of-band callback domain controlled by the attacker. This behavior aligns with dependency confusion attack patterns, where a high version number is published publicly to supersede private internal packages, causing the malicious code to execute in victim environments during dependency resolution.

If this malicious package is installed, it can leak sensitive host information and environment details to an attacker-controlled domain, potentially exposing internal system context and network information. This can aid attackers in further reconnaissance and targeted attacks. There are no known exploits in the wild at this time.

No official patch or remediation is currently provided. Users should avoid installing or depending on [email protected]. Review and enforce strict package source controls to prevent dependency confusion attacks, such as using scoped packages, private registries, or package allowlists. Monitor dependency versions carefully to avoid inadvertently pulling high-version public packages that override internal ones. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.