The ecto-corsair-flag-7kq3mz npm package uses lifecycle hooks (preinstall, install, postinstall) to run a postinstall.js script unconditionally on npm install. This script collects hostname, current working directory, user ID, and environment variables related to FLAG/CTF/NPM/REGISTRY/CI/GITHUB/RUNNER. It recursively searches directories such as /app, /workspace, /challenge, and others for strings resembling flags. The collected data is base64-encoded and sent via HTTP PUT to a remote IP address, with an additional GET request to a webhook URL. The package also checks npm_config_registry for signs of dependency confusion. Despite framing as a CTF probe, it performs unauthorized exfiltration of environment and filesystem data to an attacker-controlled endpoint.

Installation of affected versions of this package results in unconsented exfiltration of potentially sensitive environment variables and filesystem contents to an attacker-controlled server. This compromises confidentiality of the host environment and any sensitive data present in searched directories. The malicious behavior occurs automatically during package installation without user consent.

No official patch or remediation is currently available. Users should avoid installing the ecto-corsair-flag-7kq3mz package, especially versions 1.0.0, 1.0.1, and 1.0.2. Review and audit dependencies before installation to prevent supply chain compromise. Monitor for and remove this package if found in existing environments. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.