The amundi-compare npm package at version 999.9.12 is a malicious package published with an inflated version number, consistent with dependency confusion attacks targeting internal package names. It includes a preinstall script (node index.js) that runs automatically on npm install, harvesting detailed system and network information such as hostname, OS user, home directory, current working directory, local and public IP addresses, DNS resolver IP, client subnet, and metadata from the parent project's package.json. The stolen data is exfiltrated to a hardcoded callback domain via three parallel channels: HTTP POST, HTTPS POST to a specific path, and a DNS covert channel that encodes the data into subdomain labels to bypass egress filtering. The package misrepresents itself as authorized security research, but the data collection and exfiltration occur without user consent or configuration.

This malicious package can lead to unauthorized disclosure of sensitive system and network information, including internal project metadata and network configuration details. The use of a covert DNS channel for data exfiltration increases the likelihood of bypassing network security controls, potentially enabling attackers to gather reconnaissance data stealthily. There is no indication of direct code execution beyond the preinstall script, but the privacy breach and potential for further targeted attacks are significant.

Users should avoid installing the amundi-compare package at version 999.9.12. Since no official patch or remediation is indicated, the best mitigation is to remove this package if installed and audit dependencies for suspicious or unexpected packages, especially those with unusually high version numbers. Implementing strict package source verification and dependency management policies can help prevent dependency confusion attacks. Monitor for any unauthorized network traffic to the identified callback domain and block it at network boundaries.