The 'afterpay-sdk-example-server' npm package versions 20.0.0 and 1.2.1 include a preinstall hook that runs automatically during npm install. This hook executes a Node.js script that gathers extensive system and user information such as __dirname, os.homedir(), os.hostname(), os.userInfo(), DNS server details, and the full contents of /etc/passwd and /etc/hosts. It then sends this data via HTTPS POST to a malicious domain associated with Burp Collaborator OAST infrastructure. The package name is crafted to impersonate an internal Afterpay SDK example, indicating a dependency confusion attack vector. The OpenSSF Package Analysis and other sources classify this package as malicious. Any system installing this package is considered fully compromised, with a high risk of secret and key exposure.

Systems that install this package leak sensitive host and user information to an attacker-controlled endpoint, potentially exposing system accounts, DNS configurations, and other critical data. The compromise is severe enough that all secrets and keys on the affected system should be rotated immediately from a different, trusted machine. The attacker may have full control over the compromised system, and simply removing the package does not guarantee removal of all malicious artifacts.

No official patch or remediation is available. Users should immediately remove the 'afterpay-sdk-example-server' package versions 20.0.0 and 1.2.1 if installed. All secrets and credentials stored on the affected system must be rotated from a separate, secure environment. Due to the potential full compromise, consider rebuilding or thoroughly cleaning the affected system. Avoid installing packages from untrusted sources and verify package authenticity before installation.