The '@checkrhq/adjudication-api-client' npm package version 0.0.2 includes a preinstall lifecycle script that runs a curl command to POST reconnaissance data—hostname, current user, working directory, and uid/gid—to a hardcoded webhook.site URL. The package is published under a scope impersonating Checkr Inc. and contains no legitimate functionality, matching the pattern of malicious dependency confusion beacons designed to collect environment information from victims. This behavior was identified by Amazon Inspector and the OpenSSF Package Analysis project, which flagged the package as malicious due to execution of commands associated with malicious activity.

Installing this package causes automatic outbound transmission of sensitive host and user environment information to an anonymous third-party collector. This exposure of system identifiers can aid attackers in reconnaissance and further targeted attacks. There is no indication of additional payloads or direct system compromise beyond data exfiltration in the provided information.

No official patch or remediation is available for this package. The package should be considered malicious and avoided entirely. Users and organizations should audit their dependencies to ensure this package is not included, especially in internal or scoped namespaces. Removing or blocking this package from installation prevents the data exfiltration behavior. Monitor package sources carefully to avoid dependency confusion attacks.