The enbd-react-error-boundry package (version 6.0.0) is a malicious npm package published by the user 'click2ai' as part of a dependency confusion and reconnaissance campaign targeting organizations using an 'enbd' internal namespace. It contains a preinstall lifecycle script that runs automatically during npm install, which initializes the @sentry/node client with a hardcoded attacker-controlled Sentry DSN configured to send default PII. The script fetches the installing host's public IP from Cloudflare's /cdn-cgi/trace endpoint, attaches it along with other telemetry to a deliberately triggered exception, and flushes this event to the attacker's Sentry project. This allows the attacker to collect telemetry and identify successful installs by victim organization. Additionally, the package exports an init function that falls back to the same hardcoded DSN if no DSN is supplied, silently routing any captured errors and PII from the consumer to the attacker. The package name is a misspelling of the legitimate react-error-boundary package and does not provide the expected API, indicating its malicious intent. This package should be considered fully compromising any system where installed.

Any system that installs or runs this package is considered fully compromised. The preinstall hook exfiltrates sensitive telemetry including public IP, hostname, OS username, and runtime metadata to an attacker-controlled Sentry project. The attacker can identify which organizations have installed the package via distinct Sentry project IDs. Furthermore, the package can silently redirect error telemetry from the consumer's environment to the attacker, leaking potentially sensitive information. Because the compromise occurs at install time, it can lead to unauthorized data disclosure and potential further system compromise. All secrets and keys on affected systems should be rotated immediately from a clean environment.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove the enbd-react-error-boundry package version 6.0.0 from all affected systems. Consider all systems with this package installed as fully compromised and rotate all secrets and credentials from a separate, secure environment. Review and correct any dependency resolution configurations to prevent dependency confusion attacks, ensuring private/internal packages are resolved correctly and not overridden by public packages. Monitor for any further suspicious packages mimicking internal namespaces.