The @sudoughnym/enviro-demo npm package at version 99.99.99 includes lifecycle scripts (preinstall.js and postinstall.js) that run automatically on npm install. These scripts gather detailed host and environment information such as os.hostname(), process.cwd(), pid, node version, platform, process.env.USER, the first ten environment variable names, and the total count of environment variables. This collected data is then POSTed as JSON to a third-party webhook URL (https://webhook.site/f83b073c-a04a-4ac5-8930-507051bd22f7) that is not affiliated with the package publisher. The package is intended as a dependency confusion attack proof-of-concept, using a high semver (99.99.99) to supersede internal packages named 'enviro'. The impact is the leakage of host identity and environment variable layout, potentially exposing secret names, to an attacker-controlled endpoint on every installation.

Any build or developer machine that installs @sudoughnym/[email protected] will have host identity and environment metadata exfiltrated to an attacker-controlled external webhook. This includes potentially sensitive environment variable names that could aid further attacks or reconnaissance. The data leakage occurs automatically on installation without user interaction beyond the install command. This compromises confidentiality of environment details and may facilitate subsequent targeted attacks.

Avoid installing the @sudoughnym/enviro-demo package, especially version 99.99.99. Verify package names and versions carefully to prevent dependency confusion attacks. Since this is a malicious package published to the public npm registry, do not trust packages with suspiciously high version numbers intended to override internal packages. There is no official patch or fix; remediation involves removing the package and auditing systems for any data exfiltration. Consider using package allowlists or private registries to prevent resolution to malicious public packages.