The @cats-cdf/authentication npm package versions 3.1.1 and 2.17.1 include a malicious preinstall script that executes during installation. The script collects sensitive environment information—specifically the installer's local username (via whoami), hostname, and public IP address (queried from ifconfig.me)—and transmits these details as query parameters in an HTTP GET request to a hardcoded subdomain of oast.fun. The domain oast.fun is known for facilitating out-of-band interactions used in reconnaissance and exfiltration, particularly in dependency confusion attacks. This exfiltration occurs automatically without user interaction or relation to the package's intended functionality.

The malicious preinstall script leaks sensitive environment information including the local username, hostname, and public IP address of the system performing the npm install. This information disclosure can aid attackers in reconnaissance and potentially facilitate further targeted attacks such as dependency confusion or supply chain compromise. There is no indication of active exploitation in the wild at this time.

No official patch or remediation guidance is provided in the available data. Users should avoid installing the affected versions (=3.1.1 and =2.17.1) of the @cats-cdf/authentication package. Review and audit dependencies before installation, and consider using package integrity verification tools or alternative trusted packages. Monitor vendor advisories for updates or patches addressing this malicious behavior.