This malicious npm package declares a postinstall hook that executes index.js upon installation. The script gathers system information including OS username, current working directory, hostname, and non-internal IPv4 addresses using Node.js OS and process APIs. It then sends this information as JSON via HTTPS POST to a hardcoded webhook.site URL. The package name and version (99.9.9) are crafted to override an internal package through dependency confusion. The package's sole purpose is data exfiltration during install time, with no legitimate functionality matching its name.

The package can leak sensitive environment information such as usernames, hostnames, current directories, and network interface details to an attacker-controlled endpoint. This information disclosure could aid attackers in further reconnaissance or targeted attacks. There is no indication of remote code execution or persistence beyond the install-time data exfiltration.

Users should avoid installing the 'clover-codelab-remote-pay-cloud' package version 99.9.9 from untrusted sources. Verify package authenticity and source before installation. Since no official patch or fix is indicated, the primary mitigation is to remove or block this malicious package and audit dependency sources to prevent dependency confusion attacks.