The int_sezzle_sfra npm package version 25.2.1 includes a preinstall script (node index.js) that runs automatically on npm install. This script gathers host reconnaissance data including hostname, operating system information, username, user and group IDs, shell, home directory, current working directory, and the output of 'whoami' and 'id' commands executed via child_process.exec. The collected data is sent as JSON to a hardcoded Burp Collaborator OAST subdomain controlled by the attacker. The package's naming mimics Sezzle's internal Salesforce Commerce Cloud cartridge, consistent with a dependency confusion attack targeting private vendor packages. This leads to unauthorized exfiltration of sensitive environment information from the installer machine.

Installing this malicious package causes unconsented exfiltration of sensitive host and user information to an attacker-controlled server. This compromises the privacy and security of the installer's environment and could facilitate further targeted attacks. There is no indication of remote code execution beyond the install-time script or direct system compromise, but the data leakage itself is a significant privacy and security risk.

No official patch or remediation is currently documented. Users should avoid installing the int_sezzle_sfra package version 25.2.1 from untrusted sources. Verify package authenticity before installation, especially for packages mimicking internal vendor names. Monitor for updates from the vendor or npm registry regarding removal or replacement of the malicious package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.