The 'csv-parser-helper' npm package (version 1.0.0) contains malicious code embedded in a postinstall.js script that runs automatically during installation. This script gathers extensive reconnaissance data from the host environment, such as hostname, current user, working directory, system information, container detection, process tree, network info, and environment variables that may include secrets like GITHUB_TOKEN and cloud provider keys. It also probes AWS and Tencent cloud metadata services. The collected data is base64-encoded and exfiltrated via an HTTP GET request to a hardcoded Burp Collaborator domain, indicating intentional data theft. The package's advertised CSV parsing functionality is a cover; the index.js file contains unrelated code and no CSV parsing.

This malicious package can lead to significant information disclosure, including sensitive environment variables and cloud instance metadata, potentially exposing credentials and secrets. This can facilitate further compromise of the affected system or cloud environment. The exfiltration of data to an attacker-controlled domain represents a direct breach of confidentiality.

No official patch or remediation is currently available. Users should immediately remove and avoid installing the 'csv-parser-helper' package version 1.0.0. Audit existing environments for installations of this package and investigate for potential data exposure. Use trusted package sources and verify package authenticity before installation. Monitor for suspicious network activity related to the exfiltration domain. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.