The frontend-vue-next npm package declares a 'preinstall' script that runs index.js automatically on npm install. This script gathers system identity details including hostname, user information (username, uid, gid, shell), platform, architecture, home directory, current working directory, CPU and memory info. It also executes shell commands 'whoami' and 'id' to collect additional user identity data. All collected information is sent via HTTP POST to a hardcoded attacker-controlled URL (a Burp Suite Collaborator out-of-band domain). The package metadata is empty and the package name is designed to appear related to Vue/Next.js to lure victims. Versions 1.0.0 and 1.2.0 are affected.

Installing the affected versions of frontend-vue-next results in unauthorized exfiltration of sensitive system and user identity information to an attacker-controlled server. This compromises the confidentiality of the host environment and user credentials, potentially enabling further targeted attacks or reconnaissance. The malicious behavior occurs silently during package installation, increasing the risk of unnoticed data leakage.

No official patch or remediation is currently documented. Users should avoid installing frontend-vue-next versions 1.0.0 and 1.2.0. Verify package authenticity before installation and prefer well-known, verified packages. Monitor for suspicious network activity during npm installs. Check vendor or repository advisories for updates or removal of the malicious package.