The electrode-ota-ui-app npm package at version 99.0.1 is a malicious package designed to exploit dependency confusion. It declares a post-install script and a main entry point that both execute a function collecting host identifiers (hostname, user info, platform, OS release) and public IP geolocation data from external services. This data is then exfiltrated via an HTTP POST request to a hardcoded Burp Collaborator subdomain controlled by the attacker. The package's inflated version number (99.0.1) is intended to win dependency resolution over a private internal registry, causing unintended installation and data leakage.

Any system that installs this package version 99.0.1 may have sensitive host information and public IP geolocation data exfiltrated to an attacker-controlled server. This can lead to information disclosure and potential further targeting. The malicious code runs automatically on npm install and on any require() of the package, increasing the risk of compromise in development or deployment environments relying on this package name.

Avoid installing electrode-ota-ui-app version 99.0.1 from public npm registries. Verify package sources and lock dependencies to trusted internal registries. Since no official patch or fix is indicated, do not use this version. Remove any installations of this package version and audit environments for potential data leakage. Monitor dependency resolution configurations to prevent dependency confusion attacks.