Malicious code in cscasereadserv-paypal (npm)

The cscasereadserv-paypal npm package version 3.4.3 executes a preinstall script that collects the installer's OS username, hostname, current working directory, and the name, author, and version of the surrounding project's package.json by traversing parent directories. This information is encoded and exfiltrated in chunks through DNS lookups to attacker-controlled subdomains under jgl.red. The exfiltration uses a fallback DNS query on error. A source comment suggests the code may have been intended for dependency-confusion or bug bounty reconnaissance, but it effectively leaks identifying and project metadata to an external party.

This malicious behavior compromises user privacy and project confidentiality by leaking sensitive environment and project metadata to an attacker-controlled domain. It may expose private project details and user information, potentially aiding further attacks or reconnaissance. There is no indication of direct code execution or system compromise beyond data exfiltration. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, users should avoid installing or using version 3.4.3 of cscasereadserv-paypal. Consider auditing dependencies for malicious scripts and use trusted package sources. Monitor for updates from the package maintainer or security advisories regarding this issue.