The @uisp/utils package published to the public npm registry under the @uisp scope at versions 99.0.0, 99.0.1, and 99.0.2 includes a preinstall script that executes 'node beacon.js'. This script runs 'whoami' via child_process.execSync and sends the base64-encoded output to a hardcoded Burp Collaborator domain through DNS lookups and HTTPS GET requests. Installing this package from the public registry or any misconfigured registry that falls back to it causes automatic execution of attacker-controlled code on the build host and leaks host identity information to an external collector. The README's claim of authorized research does not mitigate the risk or consent for this behavior.

Installation of affected versions of the @uisp/utils package results in remote code execution on the build host at install time and exfiltration of sensitive host identity information to an external attacker-controlled server. This compromises the security and privacy of the build environment and may facilitate further attacks.

No official patch or fix is currently available. Users should avoid installing the affected versions (=99.0.0, =99.0.1, =99.0.2) of the @uisp/utils package from the public npm registry. Verify registry configurations to prevent fallback to the public registry for private packages. Monitor for updates from the package maintainers or npm advisories for remediation guidance.