The preinstall lifecycle script in cdf-tag-commander-helper versions 3.1.1 and 3.6.2 runs automatically during npm install. It executes 'whoami' and 'hostname' commands, fetches the public IP address from ifconfig.me, and sends these details as query parameters in an unencrypted HTTP GET request to a hardcoded Interactsh-style out-of-band callback domain (kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun). This network activity is not disclosed in the package README and serves as a reconnaissance beacon consistent with dependency confusion attacks, enabling attackers to identify internal build environments and user accounts resolving this package name.

The malicious preinstall script leaks sensitive environment information including the username, hostname, and public IP address of the machine installing the package. This information disclosure can aid attackers in mapping internal build infrastructure and user identities, facilitating targeted dependency confusion attacks. No direct exploitation or further payloads are described, and no known exploits in the wild have been reported.

No official patch or remediation is currently documented. Users should avoid installing cdf-tag-commander-helper versions 3.1.1 and 3.6.2. Review and verify package integrity before installation, and consider using package integrity verification tools or locking dependencies to trusted versions. Monitor for updates or advisories from the package maintainers or npm registry for official fixes.