Malicious code in @coopeuch/config (npm)

The @coopeuch/config package at version 1.999.999 publishes a stub index.js designed to override internal scope resolution when scope-to-registry mappings are missing. During npm install, a postinstall script runs that collects extensive host identity data (hostname, username, user/group IDs, home directory, network interface addresses and MACs, DNS servers, reverse DNS internal FQDN), CI/orchestration environment markers, npm context, container detection via /proc/1/cgroup, and metadata about the consuming parent package (name, version, declared version range). This aggregated information is sent via HTTPS POST to a hardcoded external endpoint (collector.oob.s4yhii.com/_npm-poc/beacon) and also triggers a DNS beacon under *.oob.s4yhii.com. The data exfiltration occurs automatically without user consent, potentially leaking sensitive internal infrastructure and project details.

This malicious package compromises confidentiality by exfiltrating sensitive internal infrastructure information and private project identifiers to an external attacker-controlled server. The automatic execution at install time means any organization resolving this package from the public npm registry risks unintended data leakage. There is no indication of further exploitation beyond data collection in the provided information.

Patch status is not yet confirmed — check the vendor advisory or npm registry for current remediation guidance. Until a fix or official advisory is available, avoid installing or resolving the @coopeuch/config package at version 1.999.999 from the public npm registry. Implement strict package source controls and audit dependencies to prevent accidental inclusion of this malicious package.