[email protected] is a malicious npm package published as a dependency-confusion beacon with an implausibly high version number to shadow an internal package name. Its postinstall lifecycle script runs notify.js, which reads the operating system hostname and sends an HTTP GET request to a hardcoded IP address (http://91.201.215.48:8000/npm-poc-bcc) including the installer's hostname, package name, and a timestamp as query parameters. The package also references webhook.site in the same file. It provides no legitimate library functionality and solely serves to transmit installer identity to an attacker-controlled destination during installation.

The package leaks sensitive information about the system installing it, including the hostname, which could be used for reconnaissance or further targeted attacks. The presence of a hardcoded attacker-controlled endpoint means that any installation of this package results in data exfiltration. There is no indication of code execution beyond the postinstall script or direct system compromise, but the information leak itself poses a privacy and security risk.

No official patch or remediation is indicated. Users should avoid installing the bcc-design package at version 9999.0.0. Since this is a malicious package published to npm, organizations should implement supply chain security measures such as package allowlisting, verifying package provenance, and monitoring for suspicious package versions. Check the npm registry and vendor advisories for any updates or removals of this package.