The 'boardwalk-js-tests' npm package version 1.1.1 includes a malicious preinstall script (node index.js) that gathers sensitive system information such as hostname, username, home directory, DNS servers, and contents of /etc/passwd and /etc/hosts. It then sends this information as a JSON payload over HTTPS to a Burp Collaborator subdomain controlled by an attacker. The package has no advertised functionality beyond this malicious behavior. Due to the nature of the compromise, any system with this package installed is considered fully compromised, and secrets or keys stored on the system should be rotated from a separate, trusted machine.

Installation of this package results in unauthorized disclosure of sensitive system information to an attacker-controlled server. The compromise is severe enough that the affected system should be treated as fully compromised, with potential for further malicious activity beyond the initial data exfiltration. All secrets and keys on the system are at risk and require immediate rotation from a different, secure environment.

Remove the 'boardwalk-js-tests' package version 1.1.1 immediately from affected systems. Treat any system with this package installed as fully compromised. Rotate all secrets, keys, and credentials that were stored or used on the compromised system from a separate, secure machine. There is no indication of an official patch or fixed version; therefore, do not reinstall this package or any untrusted versions. Conduct a thorough security assessment of the affected system to identify and remediate any additional malicious artifacts.