The 'xrblocks-remote-control' npm package (version 22.0.0) includes a 'bin' script that, when executed (including via npx or unintended resolution), sends the basename of the environment variable 'INIT_CWD' (the installer's project directory) along with a timestamp to a remote callback URL at 'https://deepbounty.dd06-dev.fr/cb/46b252ec-a089-4f22-8b5e-5cee945106dc'. The package lacks any advertised functionality and is described as a 'Security PoC for Bug Bounty' in its package.json. This behavior constitutes unauthorized data transmission and is likely part of a dependency confusion or typosquatting attack vector targeting Google's 'xrblocks' namespace. No main module is shipped, and the only effect of the package is this outbound beacon.

Installation or invocation of this package results in the unauthorized transmission of the installer's project directory name and a timestamp to an external third-party server without user consent. This can lead to information leakage about the project environment and potentially aid attackers in further targeting or reconnaissance. There is no indication of additional malicious payloads or code execution beyond this data exfiltration.

No official patch or remediation is currently documented. Users and build systems should avoid installing or resolving the 'xrblocks-remote-control' package, especially version 22.0.0. Verify dependencies carefully to prevent dependency confusion or typosquatting attacks. Monitor package sources and lock dependencies to known good versions. Patch status is not yet confirmed — check the vendor advisory or trusted sources for current remediation guidance.