[email protected] runs a postinstall lifecycle script that collects host identifiers including hostname, platform, architecture, Node.js version, and package name. It then sends this information as JSON to a hardcoded external host (m743pyrm.instances.poc.jchunt.top) at the path /code-assist-mcp. This beacon activates automatically during npm install without user opt-in. The package name mimics Google's platform-ai code-assist tooling, suggesting it is used for reconnaissance in dependency confusion or typosquatting attacks to confirm code execution on build machines.

The malicious postinstall script leaks sensitive host environment details to an attacker-controlled server, potentially exposing build machine characteristics and confirming successful code execution. This can facilitate further targeted supply chain attacks or reconnaissance. There is no indication of direct code execution beyond the data exfiltration, and no known exploits in the wild have been reported.

No official patch or remediation is currently documented. Users should avoid installing [email protected] and verify package authenticity before installation. Consider using package integrity verification and restricting installation of untrusted or suspicious packages. Monitor for updates or advisories from npm or the package maintainer for remediation.