The 'gx-npm-feature-flags' package at version 99.99.99 is a malicious package that abuses dependency confusion by using a high semantic version number and a 'gx-' prefix to outrank internal packages. Upon installation, it runs a 'postinstall' script (beacon.js) that gathers sensitive environment and system metadata and exfiltrates it via two channels to a hardcoded '*.oast.me' domain: a DNS lookup encoding key data as subdomains and an HTTPS GET request with a base64-encoded JSON payload. The dual-channel exfiltration aims to bypass network filtering and logging. Although the package README claims it is for authorized security research, this does not authorize third-party users who inadvertently install it, exposing their build and CI environment details to an external collector. The OpenSSF Package Analysis project and Amazon Inspector have flagged this package as malicious due to its communication with a domain linked to malicious activity.

Installation of this package results in unauthorized exfiltration of environment and system information from the host machine to an external attacker-controlled domain. This leakage includes potentially sensitive data such as hostnames, user identities, working directories, environment variable names, and Node.js version, which could facilitate further targeted attacks or reconnaissance. The exfiltration methods are designed to evade common network monitoring and egress filtering controls, increasing the risk of unnoticed data leakage.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing 'gx-npm-feature-flags' version 99.99.99 or any similarly suspicious packages, especially those with unusually high version numbers or 'gx-' prefixes that may indicate dependency confusion squats. Organizations should audit their dependencies to detect and remove this package if present. Additionally, implement strict controls on package sources and consider using allowlists or internal registries to prevent accidental installation of malicious packages. Monitor for and block DNS and HTTPS communications to suspicious domains such as '*.oast.me'.