The 'broadcast-graphics-mcp' npm package version 1.0.0 includes a postinstall script that runs automatically during 'npm install'. This script gathers various host identifiers (os.hostname(), platform, architecture, node version, package name, npm lifecycle event, timestamp) and transmits them via an HTTP POST request to a hardcoded external endpoint '2obx43du.instances.poc.jchunt.top' at the path '/broadcast-graphics-mcp'. The endpoint is not affiliated with the package users or first-party services, resulting in unauthorized leakage of host metadata. Although the package self-identifies as a 'security research canary', this does not mitigate the unauthorized data exfiltration behavior.

Installation of this package version leads to automatic exfiltration of sensitive host metadata to a remote, author-controlled server. This compromises the privacy of the installer environment and may facilitate further targeted attacks or reconnaissance by the malicious actor controlling the endpoint. No direct code execution beyond the postinstall script is described, and no known exploits in the wild have been reported.

Avoid installing the 'broadcast-graphics-mcp' package version 1.0.0. Since no patch or remediation is indicated, users should remove this package if installed and refrain from using it. Consider auditing dependencies for malicious postinstall scripts before installation. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.