The @dsft/ft-element npm package version 2.5.9 includes a preinstall hook that runs index.js, which reads the environment variable INIT_CWD to determine the installing project's directory name. It then sends this information in a JSON payload to a hardcoded external URL (https://deepbounty.dd06-dev.fr/cb/e51c2215-3fa8-48f1-ad64-1cf792e0cccc). This action occurs silently during npm install without disclosure or consent, leaking potentially sensitive project identifiers. The package is published under the @dsft scope and is described by its author as a dependency-confusion proof of concept. Despite this, the behavior constitutes a supply-chain attack vector by confirming dependency-confusion takeover targets. The GHSA-malware advisory states that any system with this package installed should be considered fully compromised, recommending immediate secret rotation and package removal.

The package leaks the installing project's directory name to an attacker-controlled endpoint during installation, which can reveal private project or repository names. This confirms successful dependency-confusion attacks and may enable further targeted attacks. The GHSA-malware advisory considers any system with this package installed as fully compromised, implying potential unauthorized control or data exposure. Secrets and keys stored on affected systems should be rotated immediately. Removal of the package alone may not eliminate all malicious software resulting from the compromise.

No official patch or fix is currently available for this malicious package. Immediate removal of @dsft/ft-element version 2.5.9 from all systems is strongly recommended. All secrets and keys on affected systems should be rotated from a separate, uncompromised device. Monitor for any signs of further compromise. Avoid installing packages from untrusted or unknown scopes, and verify package authenticity before installation. Check vendor or repository advisories for updates or remediation guidance.