The 'blots' npm package versions 2.1.0 and 2.1.1 include lifecycle scripts in package.json that run curl commands during installation. These commands transmit sensitive environment information—such as the installer's username (via whoami), hostname, current working directory, and timestamp—as query parameters to a webhook.site URL controlled by the package author. The package does not offer any documented or functional features beyond this data exfiltration, classifying it as malicious. This behavior was identified by the OpenSSF Package Analysis project and Amazon Inspector, which flagged the package for executing commands associated with malicious activity.

Installation of the affected 'blots' package versions results in unauthorized disclosure of environment details to an attacker-controlled endpoint. This reconnaissance data could be used to further target the affected system or user. There is no indication of additional payloads or direct system compromise beyond this information leakage.

No official patch or remediation is currently documented. Users should avoid installing versions 2.1.0 and 2.1.1 of the 'blots' package. If already installed, remove the package and audit systems for any suspicious activity. Monitor package sources and prefer verified or trusted packages. Check vendor advisories or npm security advisories for updates or removal notices regarding this package.