The 'dbk-ui-forms' npm package version 99.0.1 includes a preinstall hook that runs a script (index.js) which gathers detailed host identity information such as hostname, username, home directory, network interfaces, user IDs, and outputs of system commands (whoami, id, pwd, uname -a). It also scans environment variables for names matching a broad credential pattern (including keys, tokens, secrets, passwords, authentication, and CI/CD related variables). The collected data is serialized as JSON and sent to a hardcoded Interactsh subdomain via HTTPS POST, HTTP POST, and DNS-encoded lookups. This package appears to be a malicious dependency confusion beacon designed to target internal build environments that inadvertently resolve this unclaimed package from the public npm registry.

Sensitive host and credential-related information can be exfiltrated from systems that install this package, potentially leading to credential compromise and further system or network intrusion. The malicious behavior occurs during package installation, which may affect automated build or CI/CD pipelines that resolve this package name.

No official patch or remediation is currently documented. Users should avoid installing version 99.0.1 of the 'dbk-ui-forms' package. Review and restrict package sources in build systems to prevent dependency confusion attacks by ensuring internal packages are properly scoped and not resolvable from public registries. Monitor for unexpected network traffic to unknown domains during package installation. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.