The npm package @flipbit2-bb/[email protected] includes a postinstall script (phone-home.js) that collects system information such as hostname, username, platform, OS release, timestamp, and package label, then sends this data via HTTPS GET to an external webhook URL. The package is crafted to impersonate an internal Atlassian package (@atlassiansox/[email protected]) to exploit dependency confusion, increasing the likelihood of installation in environments expecting the internal package. The malicious payload leaks sensitive host identifiers and potentially compromises the system. According to the source, any system with this package installed or running should be considered fully compromised, with all secrets and keys rotated immediately from a separate, trusted system. Removal of the package alone may not eliminate all malicious components.

Installation of this package results in leakage of host identifiers to an attacker-controlled endpoint and may lead to full system compromise. The attacker may gain control over the affected system, risking exposure of all stored secrets and keys. The compromise is severe enough that secret rotation and comprehensive remediation are required. The package itself has no legitimate functionality and serves solely as a malicious payload.

Remove the @flipbit2-bb/test-auth-state package version 0.0.2 immediately. Rotate all secrets and keys stored on the affected system from a separate, trusted environment. Because full system compromise is possible, assume that removal of the package alone may not fully remediate the system; consider rebuilding or thoroughly auditing the system for persistence mechanisms. Monitor for any unexpected network connections or processes related to this package. There is no official patch or fix; avoidance and removal are the primary mitigations.