The 'airkey-mfa-react' npm package versions 36.1.1, 35.1.1, 29.1.1, and 20.0.1 include a preinstall script that auto-executes 'node test.js' on installation. This script collects username, hostname, platform, Node.js version, and CI environment flags, sending them to a malicious external domain. Additionally, the package runs system commands ('whoami' and 'id') to gather user and system context, which it also exfiltrates to another malicious domain. The exfiltrated payload includes a label indicating a dependency-confusion probe against an internal package namespace. The package's communications are linked to known malicious activity domains, confirming its malicious nature.

Any system that installs or runs this package is considered fully compromised. The attacker gains access to sensitive system and user information, potentially enabling further exploitation. All secrets and keys stored on the compromised system should be assumed exposed and must be rotated immediately. Removing the package alone may not eliminate all malicious artifacts or backdoors introduced by the package.

No official patch or remediation is currently available. Immediate removal of the 'airkey-mfa-react' package versions 36.1.1, 35.1.1, 29.1.1, and 20.0.1 is recommended. Systems with this package installed should be treated as compromised; rotate all secrets and keys from a secure, unaffected system. Conduct a thorough investigation for additional persistence mechanisms or malware. Monitor for any unusual outbound network traffic related to the identified malicious domains.