The 'aedes_clusters' npm package version 1.0.1 declares a 'preinstall' script that runs 'node index.js' during installation. This script performs host reconnaissance by gathering OS hostname, username, home directory, DNS configuration, and reads local files such as /etc/passwd and /etc/hosts. It then sends this data via HTTPS POST to a hardcoded Burp Collaborator subdomain (b5hv16nakzo45px5ga4ukkum8de52vqk.oastify.com), which is an attacker-controlled exfiltration endpoint. The package has no legitimate purpose and solely functions to collect and exfiltrate sensitive system information, indicating a fully compromised system upon installation.

Any system with this package installed should be considered fully compromised. Sensitive information including system user details and configuration files may have been exposed to an attacker. All secrets and keys stored on the affected system should be rotated immediately from a different, trusted system. Removing the package alone may not fully remediate the compromise due to potential additional malicious software installed.

Remove the 'aedes_clusters' package version 1.0.1 immediately from affected systems. Rotate all secrets, keys, and credentials that were stored on the compromised system using a separate, secure environment. Because the system may be fully compromised, consider rebuilding or thoroughly auditing the system for further malicious artifacts. No official patch or fix is available; the package itself is malicious.