The 'chrome-enterprise-premium-mcp' npm package (version 1.0.0) includes a malicious postinstall lifecycle script that executes automatically during 'npm install'. This script gathers host metadata such as os.hostname(), platform, architecture, Node.js version, package name, npm lifecycle event, and timestamp, then sends this data via a POST request to a hardcoded external endpoint (https://0vi0ck12.instances.poc.jchunt.top/chrome-enterprise-premium-mcp). The external domain is unrelated to Google or Chrome infrastructure, indicating the package is a typosquatting or dependency confusion canary beacon designed to leak installer identity to a third party.

The malicious postinstall script leaks detailed environment metadata to an unauthorized external server, potentially exposing sensitive information about the host system and the user installing the package. This can lead to privacy violations and may aid attackers in reconnaissance or targeted attacks. There is no indication of further exploitation beyond data leakage. No known exploits in the wild have been reported.

No official patch or remediation is currently documented for this package. Users should avoid installing 'chrome-enterprise-premium-mcp' version 1.0.0. Verify package authenticity before installation, especially for packages mimicking well-known products. Monitor for updates or advisories from trusted sources regarding this package. Since this is a malicious package, removing it from your dependencies and clearing any cached versions is recommended.