The npm package [email protected] and 99.0.1 is a version-inflated malicious package published under a scope resembling an internal namespace. Its package.json declares a preinstall script that runs index.js on npm install. This script collects host identifiers such as hostname, platform, user info, home directory, and network interfaces, as well as outputs from shell commands (uname, id, whoami). It enumerates environment variables for keys matching sensitive patterns related to credentials and tokens. The collected data is exfiltrated via HTTP(S) POST requests and DNS lookups to a hardcoded callback host at ycwyyoimdcluajepubahl0tpb7943a2z4.oast.fun. The package self-describes as a dependency confusion proof of concept but effectively performs malicious data exfiltration on installation.

The malicious package can leak sensitive host information and environment variables containing secrets or credentials to an external attacker-controlled server. This can lead to credential compromise, unauthorized access, and further exploitation of affected systems where the package is installed.

No official patch or remediation is indicated. Users should avoid installing com.db.dbk.ui-forms versions 99.0.0 and 99.0.1. Audit and remove this package if present. Monitor for suspicious network traffic to the indicated callback domain and investigate any potential data exposure. Consider using package integrity verification and restricting installation of untrusted or suspicious scoped packages.