The 'bolt-delivery-menu-app' npm package (version 9.9.11) is a malicious package that performs DNS-based data exfiltration. Upon installation and each require call, it runs code that reads the operating system username, hostname, and current working directory, concatenates these with a campaign tag, and sends the information via DNS resolve4 queries to the attacker's domain 'oob.sl4x0.xyz'. The package uses obfuscation techniques by storing critical strings as character code arrays to evade detection by string-grep scanners. The package name and author email are part of a typosquatting campaign designed to impersonate a legitimate brand and lure victims. The README falsely claims no network requests are made, misleading users about its behavior. This results in a full compromise of any system where the package is installed.

Any system with this package installed or running is considered fully compromised. The attacker gains access to host identity information and potentially full control over the system. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately. Removing the package alone may not eliminate all malicious components or backdoors introduced by the attacker.

No official patch or fix is available for this malicious package. The recommended mitigation is immediate removal of the 'bolt-delivery-menu-app' package version 9.9.11 from all affected systems. Additionally, all secrets, credentials, and keys stored on compromised systems should be rotated from a separate, trusted environment. Due to the potential full compromise, consider rebuilding affected systems to ensure complete remediation.