The 'fund-calculator' npm package version 999.9.12 declares a preinstall script that runs unconditionally on 'npm install'. This script gathers installer-side identifiers such as hostname, user information, current working directory, home directory, and metadata from the parent project's package.json. It also obtains the installer's public IP address by making HTTPS requests to api.ipify.org, icanhazip.com, and ifconfig.me. The collected information is exfiltrated to a hardcoded callback domain 'da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun' using three methods: HTTP POST on port 80, HTTPS POST on port 443 with a path containing a UUID, and DNS queries with hex-encoded payload chunks as subdomains to bypass egress filters that block HTTP but allow DNS. The package version and name suggest it is a dependency confusion attack designed to override an internal private package of the same name.

Sensitive environment and network information from the installer machine can be leaked to an attacker-controlled server. This includes hostname, user details, project metadata, and public IP address. Such data leakage can aid attackers in reconnaissance and further targeted attacks. The use of multiple exfiltration channels, including DNS tunneling, increases the likelihood of successful data exfiltration even in restricted network environments.

No official patch or remediation is currently documented. Users should avoid installing the 'fund-calculator' package version 999.9.12 from public npm registries, especially if it conflicts with internal private packages. Verify package authenticity and source before installation. Employ strict package name policies and use scoped packages to prevent dependency confusion attacks. Monitor for suspicious preinstall scripts in dependencies.