The 'fr-ito-web-react' npm package at version 99.99.99 is identified as malicious. Its package.json declares preinstall and postinstall lifecycle scripts that execute a script named exfil.js during npm install. This script runs system commands 'whoami' and 'id' via child_process.execSync to collect user and system identity information. It then sends this data over HTTPS POST to a hardcoded attacker-controlled domain with TLS verification disabled, falling back to DNS lookup with encoded data as a subdomain. The package uses a high version number (99.99.99) typical of dependency confusion attacks to force resolution over internal packages. This behavior results in unauthorized data exfiltration without user consent.

The malicious package exfiltrates sensitive system and user identity information to an attacker-controlled server during installation. This compromises confidentiality and could facilitate further attacks by revealing system context to adversaries. There is no indication of remote code execution beyond the install-time script or persistence mechanisms. No known exploits in the wild have been reported.

Avoid installing the 'fr-ito-web-react' package at version 99.99.99. Since no patch or remediation is indicated, users should remove this package if installed and audit their systems for potential data exposure. Use trusted package sources and verify package authenticity to prevent dependency confusion attacks. Monitor for updates from the package maintainer or npm advisories for any official fixes.