The 'client-cookies-agent' npm package at versions 99.9.5 and 99.9.6 includes a postinstall script that executes automatically during 'npm install'. This script gathers system information including os.hostname(), os.userInfo(), process.cwd(), and resolves the external IPv4 address. It then sends this data as JSON over plain HTTP to a hardcoded Interactsh-style out-of-band collector domain associated with malicious activity. The package has empty description and author fields and appears to be a dependency confusion squatting attempt against private/internal package names. Installing or resolving this package causes a reconnaissance beacon to fire from the target machine, leaking host and network identifiers to the attacker.

Installation or accidental resolution of the malicious 'client-cookies-agent' package results in unauthorized disclosure of host identifiers, user information, current working directory, and external IP address to an attacker-controlled server. This confirms code execution on the target system and leaks sensitive environment details that could facilitate further attacks or reconnaissance. No direct evidence of further exploitation or payload delivery is provided.

No official patch or remediation is currently documented. Users should avoid installing or resolving the 'client-cookies-agent' package versions 99.9.5 and 99.9.6. Verify package names carefully to prevent dependency confusion attacks, especially for private or internal package namespaces. Monitor package sources and use trusted registries. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.