The crosswalker npm package declares a preinstall script in its package.json that automatically executes index.js during npm install. This script gathers sensitive host and user environment data including hostname, platform, architecture, home directory, username, user and group IDs, shell, OS details, current working directory, and the output of 'whoami' and 'id' commands. It then sends this collected information as a JSON payload to a hardcoded URL hosted on a Burp Collaborator subdomain, which is typically used for out-of-band testing and reconnaissance. This results in unauthorized exfiltration of identifying information from the installation environment without user consent.

Unauthorized collection and exfiltration of sensitive system and user environment information occurs during package installation. This compromises user privacy and may aid attackers in reconnaissance or further exploitation. The malicious behavior activates automatically on install, potentially affecting all users who install the affected versions.

No official patch or remediation is currently documented. Users should avoid installing the affected versions (=1.0.0, =1.0.1, =18.2.1) of the crosswalker package. Monitor for updates or advisories from the package maintainers or npm security teams. Consider using package integrity verification tools and audit dependencies before installation.