The easypanel-hosting package at version 1.0.0 includes a preinstall lifecycle script that gathers installer identity metadata including hostname, username, current working directory, and continuous integration environment variable names. This information is base64url-encoded and sent out-of-band via DNS queries and HTTP requests to a hardcoded subdomain under lyomeri.com. The main module exports an empty object, suggesting the package is a stub designed to probe or exploit dependency confusion. The exfiltration happens automatically during npm install, exposing sensitive environment details to an attacker-controlled server.

Sensitive environment information from the machine performing the npm install is leaked to an attacker-controlled domain. This includes hostname, username, working directory, and CI environment variables, which could aid attackers in reconnaissance and further attacks. The data exfiltration occurs without user interaction and before any legitimate code runs, potentially compromising the privacy and security of the build or deployment environment.

No official patch or remediation is currently documented. Users should avoid installing [email protected] and audit their dependency trees for this package. Monitor for suspicious DNS and HTTP requests to unknown domains such as lyomeri.com. Since no fix is confirmed, check vendor advisories or npm security advisories for updates. Consider using package integrity verification and restricting network access during npm installs as temporary mitigations.