The malicious npm package @carvana.authentication-flows/shared (version 19.2.1) contains a preinstall hook that runs unconditionally on npm install. The script gathers host identifiers such as hostname, user info, platform, architecture, home directory, current working directory, and executes system commands 'whoami' and 'id'. It then sends this collected information as JSON to a hardcoded external URL controlled by the attacker. The package name uses a misleading scope to impersonate the legitimate Carvana organization, but it does not provide any legitimate functionality. This behavior constitutes a supply chain attack vector through npm package installation.

Installation of this package leads to unauthorized collection and exfiltration of sensitive host environment and user identity information to an attacker-controlled server. This compromises confidentiality and may facilitate further targeted attacks or reconnaissance. There is no indication of additional payloads or persistence mechanisms beyond the initial data exfiltration.

No official patch or remediation is available for this malicious package. The package should be removed from any dependency lists and not installed. Users and organizations should verify package authenticity and source before installation, especially for packages with suspicious or impersonating names. Employing package integrity verification and using trusted registries can help prevent such supply chain attacks.