The fundraiserservpp npm package version 1.9.0 includes a preinstall script that executes index.js on npm install. This script gathers environment information such as hostname, platform, architecture, home directory, and configured DNS servers using the Node.js os module. It then sends this information as JSON to a Burp Collaborator subdomain, an out-of-band callback server used to confirm code execution and enumerate victim environments. This behavior is consistent with reconnaissance activity in dependency confusion attacks, allowing attackers to collect data about the victim system automatically during package installation.

The malicious code leaks sensitive environment information from the victim's machine to an external attacker-controlled server without user consent. This can aid attackers in profiling the victim environment for further targeted attacks or exploitation. While no direct code execution beyond the preinstall script is described, the unauthorized data exfiltration represents a privacy and security risk.

No official patch or remediation is currently documented. Users should avoid installing version 1.9.0 of fundraiserservpp. Verify package integrity and source before installation. Monitor for updates or advisories from the package maintainer or npm registry regarding this issue. Consider using package auditing tools to detect malicious scripts in dependencies.