The 'fundraiserservicepp' npm package at version 1.5.0 contains malicious code executed during its preinstall lifecycle event. This code collects system information including os.hostname(), os.platform(), and os.arch() and transmits it as JSON via HTTPS to a hardcoded subdomain linked to malicious activity. The package lacks advertised functionality beyond this data exfiltration behavior, indicating it is designed to collect and leak host environment details without user authorization. This behavior was identified by Amazon Inspector and the OpenSSF Package Analysis project, which flagged the package as malicious due to its communication with a known malicious domain.

The malicious package can leak sensitive host environment information such as hostname, operating system platform, and architecture to an external attacker-controlled server. This data exposure can aid attackers in profiling the victim environment for further targeted attacks or exploitation. Since the package executes this behavior automatically during installation without user consent, it poses a privacy and security risk to systems that install it.

No official patch or remediation is currently available for this malicious package. Users and organizations should avoid installing 'fundraiserservicepp' version 1.5.0 from npm. If already installed, remove the package immediately and investigate any potential data exposure. Monitor for any network connections to the identified malicious domain and block such traffic at network boundaries. Use trusted sources and verify package integrity before installation to prevent supply chain compromise.