The package @luminarycloudinternal/[email protected] and @9999.0.2 is a malicious npm package designed to exploit dependency confusion by using an internal-looking scope and an artificially high version number to supersede legitimate internal packages. Its postinstall.js script collects detailed host identifiers (hostname, username, OS details), npm package metadata, and CI/GitHub environment variables, then sends this data as query parameters to a hardcoded external endpoint (poc-luminary-npm-1782987043.testingboxes.com). The package self-identifies as a Bugcrowd bounty canary, but this exfiltration behavior is malicious for any installer other than the intended bounty target. The compromise is severe enough that any system with this package installed should be treated as fully compromised, requiring immediate secret/key rotation and thorough remediation beyond simple package removal.

Installation of this package results in exfiltration of sensitive environment and CI/CD metadata to an external attacker-controlled server. The presence of this package indicates a full system compromise, potentially allowing attackers to access secrets, keys, and other sensitive data stored on the affected system. The malicious postinstall script runs automatically on installation, increasing risk of unnoticed compromise. Removal of the package alone does not guarantee full remediation due to potential persistence or additional malicious payloads.

No official patch or fix is available. The package should be immediately removed from any affected systems. All secrets, keys, and credentials stored on compromised systems must be rotated from a secure, uncompromised environment. Due to the severity of the compromise, a full incident response and system integrity verification is recommended. Monitor for any signs of persistence or additional malicious activity resulting from the installation of this package.