The chromeos-webdriver-cli npm package version 1.0.0 includes a postinstall script that executes upon npm install. This script issues an HTTPS POST request to a hardcoded, non-first-party domain (https://kvpq6u62.instances.poc.jchunt.top/chromeos-webdriver-cli), transmitting installer-identifying information such as os.hostname(), platform, architecture, Node.js version, package name, and timestamp. The destination domain's structure suggests it functions as a canary beacon typical of dependency confusion or typo-squatting attacks, designed to exfiltrate internal hostnames and environment metadata to an unauthorized third party without user knowledge or configuration.

The malicious postinstall script leaks sensitive environment information to an external attacker-controlled server. This can disclose internal hostnames and system details that may aid attackers in further reconnaissance or targeted attacks. No direct code execution or system compromise beyond data exfiltration is described. There are no known exploits in the wild reported.

No official patch or remediation is currently documented. Users should avoid installing version 1.0.0 of chromeos-webdriver-cli. Verify package authenticity before installation and consider using package integrity verification tools. Monitor for updates or advisories from the package maintainer or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.