The 'formatters.ts' npm package version 14.2.1 includes a preinstall script that executes index.js upon installation. This script gathers extensive system information including hostname, platform, architecture, home directory, user details (username, uid, gid, shell), OS release, memory, CPU count, and command outputs from 'whoami', 'id', and 'pwd'. It then sends this data as a JSON payload to a hardcoded Burp Collaborator subdomain at https://y43nklho48nnebq8qpmw3ngha8gz4pse.oastify.com/detox56. The package mimics a legitimate formatter/TypeScript module but lacks author and description metadata, consistent with a dependency confusion typosquatting attack aimed at reconnaissance during install time.

The malicious package collects sensitive host and user environment information and exfiltrates it to an attacker-controlled server. This reconnaissance data could be used to inform further targeted attacks or compromise attempts. There is no indication of code execution beyond data collection or persistence mechanisms, and no known exploits in the wild have been reported.

No official patch or remediation is currently available. Users should avoid installing the 'formatters.ts' package version 14.2.1 from untrusted sources. Verify package authenticity before installation, especially for packages with empty or suspicious metadata. Consider using package integrity verification and dependency audit tools to detect and block typosquatting or malicious packages.