The 'github-policy-bot' npm package version 1.0.0 includes a postinstall script that gathers host-specific information such as hostname, platform, architecture, Node.js version, package name, and npm lifecycle event. It then sends this data as JSON to a hardcoded external endpoint (vlfl47tl.instances.poc.jchunt.top/github-policy-bot). The outbound request is designed to fail silently with a short timeout, consistent with a beacon for data exfiltration. The package name mimics a legitimate Google-owned repository, but the author is a placeholder named 'r00tdaddy' with a self-declared 'security research canary' label that does not alter the malicious behavior. Installing this package causes unauthorized disclosure of environment metadata to a third party.

Installation of this package results in the unauthorized transmission of host and environment metadata to an external server controlled by the attacker. This could lead to privacy violations and potential reconnaissance for further attacks. There is no indication of direct code execution or system compromise beyond data leakage. No known exploits in the wild have been reported.

No official patch or remediation is currently documented. Users should avoid installing the 'github-policy-bot' package version 1.0.0 from untrusted sources. Verify package authenticity before installation and monitor for suspicious postinstall scripts. Since the package is not a cloud service, remediation depends on user action to avoid or remove the malicious package. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.