The @assetshop/verify-cli npm package in versions 99.0.0 and 99.0.1 includes a preinstall hook that runs index.js upon installation. This script gathers installer identity and host environment details using commands like 'whoami' and Node.js OS APIs. It exfiltrates this information to a hardcoded Interactsh/OAST callback subdomain through HTTPS GET requests and DNS lookups embedding the collected data in the request paths. This pattern aligns with dependency confusion reconnaissance, aiming to confirm internal package name resolution within private registries by observing outbound network interactions.

The malicious package leaks sensitive environment and user identity information to an external attacker-controlled domain during installation. This can expose internal hostnames, user accounts, and environment details that may aid attackers in further reconnaissance or targeted attacks. There is no indication of direct code execution beyond the data exfiltration during install, and no known active exploits in the wild have been reported.

No official patch or remediation is currently documented for this package. Users should avoid installing @assetshop/verify-cli versions 99.0.0 and 99.0.1. Verify package authenticity and source before installation, and consider using trusted package registries and scopes. Monitor for updates or advisories from the package maintainer or npm regarding remediation.