The ac-raf-emitter npm package version 3.0.1 includes a preinstall lifecycle script that performs a curl POST request to a hardcoded webhook.site URL controlled by the attacker. This request transmits the hostname of the machine performing the installation and a timestamp as query parameters. The data exfiltration happens automatically during the npm install process before any consumer code executes. The webhook URL is an anonymous request-inspection endpoint unrelated to the package's advertised functionality, indicating malicious intent embedded in the package.

The malicious preinstall script can leak sensitive environment information such as the installer's hostname and installation time to an attacker-controlled endpoint. This can lead to privacy violations and potential reconnaissance by threat actors. Since the code runs automatically on npm install, users may unknowingly disclose system information without executing any other package functionality.

No official patch or remediation is currently documented for this package version. Users should avoid installing ac-raf-emitter version 3.0.1. Verify package integrity and source before installation. Consider using package auditing tools and lockfiles to prevent installation of this malicious version. Monitor vendor advisories for any future updates or fixes.