The fkext-browser-min npm package version 1.0.14 executes a preinstall lifecycle hook script named vishu.js upon installation. This script collects sensitive environment information including the public IP address (via api.ipify.org), the system hostname, and GitHub Actions/CI environment variables (GITHUB_*). It transmits this information to a hardcoded webhook.site URL over HTTPS. Additionally, it performs a DNS lookup to a subdomain formatted as ping-<hostname>.<collaborator>.oastify.com, providing an out-of-band exfiltration channel that can bypass HTTP egress filters. The package does not provide any legitimate functionality and is identified as a malicious package used for reconnaissance and beaconing in installer or CI environments.

This malicious package can leak sensitive environment information from the host machine and CI environments to an attacker-controlled server during installation. This exposure can aid attackers in profiling the target environment for further attacks or exploitation. The out-of-band DNS exfiltration channel can bypass some network egress restrictions, increasing the risk of data leakage. There is no indication of direct code execution beyond the preinstall script or further payload delivery.

No official patch or remediation is documented for this package. Users should avoid installing fkext-browser-min version 1.0.14 and remove it if present. Review and restrict package sources and dependencies to trusted repositories to prevent supply chain attacks. Monitor CI environments for unauthorized package installations and consider implementing policies to block or audit preinstall scripts. Since no fix is stated, patch status is not yet confirmed — check vendor or repository advisories for updates.