The 'domains-billing-types' npm package at version 99.91.1 contains malicious code that runs during the postinstall lifecycle event. It executes 'node index.js', which reads the local system's hostname and user information, then constructs a DNS A-record query embedding these details as subdomain labels to a domain controlled by an attacker (oastify.com). This behavior leaks sensitive environment information to an external server without user consent. The package lacks legitimate functionality and is likely a dependency confusion attempt to detect internal package namespace resolution.

Installation of this package results in unauthorized disclosure of the installer's hostname and username to an attacker-controlled domain. This information leakage can aid attackers in reconnaissance and further targeted attacks. There is no indication of additional payloads or code execution beyond this data exfiltration.

No official patch or remediation is currently available. Users should avoid installing the 'domains-billing-types' package version 99.91.1. Verify package authenticity before installation, especially for packages with anonymous authorship and no clear functionality. Monitor dependency sources to prevent dependency confusion attacks. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.