Malicious code in @coopeuch/core (npm)

The @coopeuch/core npm package at version 1.999.999 performs a dependency confusion attack by publishing a package with a version number designed to supersede internal scoped packages. Upon installation, its postinstall.js script automatically executes and collects detailed host and environment information such as hostname, user identifiers, platform details, network interfaces, DNS servers, container detection, and npm environment variables including scoped registry configuration and the parent project's package metadata. This collected data is sent as a JSON report to https://collector.oob.s4yhii.com/_npm-poc/beacon, and a DNS lookup is performed against a subdomain of oob.s4yhii.com as a secondary out-of-band channel. The package does this without the installer's consent, effectively exfiltrating sensitive environment and project information.

Unauthorized disclosure of sensitive host and environment information occurs, including internal network topology, user and system identifiers, and private project metadata. This can lead to privacy violations and potentially aid attackers in further targeting the affected environment. The attack leverages dependency confusion to trick internal package resolution, increasing the risk of inadvertent installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, avoid installing or updating to @coopeuch/core version 1.999.999. Review internal package resolution policies to prevent dependency confusion attacks, such as enforcing strict scoped package resolution and verifying package sources before installation.