The 'livekit-agents' npm package is a malicious typosquatting package that impersonates the official LiveKit Agents SDK by name and README references but does not implement the real SDK functionality. Instead, it contains a stub function and a CLI that unconditionally sends usage metrics including environment details to an attacker-controlled lookalike domain 'livekit-agents.xyz', which is distinct from the legitimate 'livekit.io' domain. The package also declares a postinstall script in its manifest that is not currently present in the shipped files, indicating preparation for future malicious payload delivery. These combined factors indicate namespace abuse and telemetry collection to identify potential victims for subsequent attacks.

Users installing this package may unknowingly send telemetry data about their environment and usage to an attacker-controlled server, potentially exposing sensitive metadata. The presence of a pre-wired postinstall hook suggests risk of future malicious code execution upon installation. Although no active exploit payload is currently delivered, the package's behavior constitutes a privacy and security risk and may lead to further compromise if updated with malicious code.

No official patch or fix is currently available. Users should avoid installing the unscoped 'livekit-agents' package and instead use the official scoped LiveKit Agents SDK from the legitimate source. Monitor for updates from the official LiveKit project and npm advisories for any remediation. Since the postinstall hook is currently inactive, immediate exploitation risk is limited, but caution is advised to prevent telemetry leakage and potential future payloads.