Malicious code in electron-internal-utils (npm)

The electron-internal-utils npm package version 1.0.0 includes a postinstall script that performs an out-of-band HTTP request to a domain controlled by the attacker. This request leaks sensitive environment information such as the public IP address and DNS resolver metadata of the host performing the installation. The package contains no actual code functionality and is designed to impersonate Electron's internal utilities namespace, consistent with a dependency confusion attack vector targeting projects referencing internal Electron helpers. The malicious behavior occurs silently during npm install without user awareness.

The malicious postinstall script leaks the installer's public IP address and DNS resolver metadata to an attacker-controlled server. This can lead to privacy breaches and reconnaissance information disclosure about the environment where the package was installed. No direct code execution or system compromise beyond information leakage is described. The package does not provide legitimate functionality and is intended to deceive developers into installing it.

No official patch or remediation is currently documented for this package. Users should avoid installing electron-internal-utils version 1.0.0 and verify dependencies to prevent dependency confusion attacks. Review package sources carefully and do not install packages that impersonate internal project namespaces. Monitor for suspicious postinstall scripts in npm packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.