This threat involves a malicious npm package named @flex-ng/header-component published by an attacker to exploit dependency confusion. The package's preinstall lifecycle script runs automatically during installation, installing @sentry/node and executing a script that collects the installer's public IP address and other personally identifiable information (PII) such as hostname, OS username, and runtime metadata. This data is sent to a hardcoded attacker-controlled Sentry project endpoint. Additionally, the package's code routes any error telemetry from consumers to the same attacker endpoint, enabling ongoing data leakage. The package name mimics an internal organizational scope to trick misconfigured resolvers into installing it instead of legitimate private packages. The malicious payload is consistent across all packages published by this attacker account, differing only in package name and target Sentry project ID. The threat is classified as a malicious package rather than a traditional vulnerability and indicates a high risk of system compromise and data leakage.

Installing this package results in unauthorized exfiltration of sensitive telemetry data including the installer's public IP, hostname, OS username, and runtime environment metadata to an attacker-controlled Sentry endpoint. The package also enables ongoing data leakage by routing error telemetry from consumers to the attacker. According to the GHSA advisory, any system with this package installed should be considered fully compromised, requiring immediate secret and key rotation. The presence of this package may allow attackers to gain full control over the affected system.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove the package from all affected systems. Because the package may have granted attackers full control, all secrets and keys stored on the compromised systems should be rotated from a separate, trusted environment. Users should audit their dependency configurations to prevent dependency confusion attacks by ensuring private packages are resolved correctly and not overridden by public packages with similar names. Monitoring and blocking suspicious packages published under organizational scopes is advised.