Malicious code in @coopeuch/components (npm)

The @coopeuch/components npm package version 1.999.999 includes a postinstall script that executes automatically on installation. This script collects a wide range of environment and network identifiers such as hostname, username, user IDs, home directory, platform details, network interface MAC addresses and CIDRs, DNS server configurations, internal reverse-DNS names, container runtime indicators, npm environment variables including registry settings, CI environment markers, and metadata from the consuming project's package.json (name, version, declared dependency range). The collected data is sent as JSON to https://collector.oob.s4yhii.com/_npm-poc/beacon, and a DNS beacon is also issued to a subdomain of oob.s4yhii.com encoding the package name. The package versioning and behavior suggest a dependency confusion attack aiming to capture internal project and environment data by masquerading as an internal scoped package. The author frames this as a 'coordinated disclosure PoC,' but the code effectively leaks sensitive information without user consent.

Installers that resolve and install this malicious package version inadvertently disclose sensitive host, network, continuous integration environment, and internal project metadata to an external third-party endpoint. This can lead to information leakage that may facilitate further targeted attacks or reconnaissance. There is no evidence of active exploitation in the wild, but the data exfiltration poses a significant privacy and security risk to affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or advisory is available, avoid installing or resolving the @coopeuch/components package version 1.999.999 from untrusted sources. Validate package sources and consider restricting or auditing installation of packages from the @coopeuch scope to prevent dependency confusion attacks. Monitor for updates from the package maintainer or npm security advisories regarding this issue.