The enbd-react-logger package (version 4.0.0) was published to the npm registry by an attacker impersonating an internal package namespace used by Emirates NBD. It includes a preinstall hook that runs automatically on npm install, executing a script that initializes the @sentry/node client with a hardcoded attacker-owned Sentry DSN and sendDefaultPii enabled. This script collects the installing host's public egress IP by querying Cloudflare's trace endpoint and deliberately triggers a runtime exception to send telemetry data including public IP, hostname, OS username, and environment metadata to the attacker's Sentry project. This enables the attacker to perform reconnaissance on victims who mistakenly install this public package due to misconfigured dependency resolution. The attack is part of a broader campaign using similar packages targeting different internal namespaces, each beaconing to distinct Sentry project IDs. The package's malicious behavior is embedded in the install-time payload and the source code, making it a severe threat. The package version affected is exactly 4.0.0. No official patch or remediation is provided by the vendor, and the package should be considered fully malicious.

Installation of this package results in unauthorized exfiltration of sensitive host telemetry and personally identifiable information (PII) including public IP address, hostname, OS username, and runtime environment metadata to an attacker-controlled Sentry project. This compromises confidentiality and privacy of the affected system. The attacker can identify which organizations have installed the package, enabling targeted follow-up attacks. The presence of the malicious preinstall script means that the compromise occurs before application code runs, increasing risk. According to external malware analysis, any system with this package installed or running should be considered fully compromised, and all secrets and keys on that system should be rotated from a different, trusted machine. Removal of the package alone does not guarantee full remediation.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove the enbd-react-logger package version 4.0.0 from all affected systems. Because the package executes code at install time and exfiltrates sensitive data, assume full system compromise upon installation. Rotate all secrets, credentials, and keys that were stored or accessible on the affected systems, performing this rotation from a separate, trusted environment. Review and correct any misconfigured dependency resolution to prevent accidental installation of public packages mimicking internal namespaces. Monitor for any further suspicious activity related to this package or similar dependency confusion attacks. There is no vendor advisory indicating any official fix or that no action is required.