The @ferudionz/webautomation npm package (version 1.0.0) includes a function connet(x) that posts the argument it receives to a hardcoded remote URL. The code is heavily obfuscated using RC4 string arrays and anti-debugging techniques, with the destination URL reconstructed at runtime from multiple decoded fragments to evade detection. The package does not document any legitimate service endpoint and has empty author metadata. The argument passed to connet() is likely a wallet or account identifier, which is silently exfiltrated to an undisclosed, author-controlled server. The combination of obfuscation, anti-debugging, and misleading presentation strongly suggests malicious intent.

Sensitive data passed to the connet() function, such as wallet or account identifiers, is exfiltrated to a remote attacker-controlled server without user consent or knowledge. This can lead to privacy violations, credential theft, or further targeted attacks depending on the nature of the exfiltrated data. There is no indication of direct code execution or system compromise beyond data leakage.

No official patch or remediation is currently available. Users should immediately remove the @ferudionz/webautomation package version 1.0.0 from their projects and avoid using it. Consider auditing dependencies for similar malicious packages and monitor for suspicious network activity related to unknown remote endpoints. Check vendor advisories or trusted security sources for updates on remediation or replacement packages.