The '@heartlandone-private/fontawesome-pro' npm package versions 6.3.3 and 6.3.6 include a postinstall script that runs index.js, which issues an HTTPS request to a Burp Collaborator subdomain at r7z7t23a9hkqmzl06zndpczfh6nxbszh.oastify.com. This request transmits identifying information about the installer, including outbound IP and DNS resolver details, to an attacker-controlled server. The package is published publicly under a private-looking scope, facilitating dependency confusion attacks. The package's sole behavior is this beaconing activity, which occurs without user consent or control.

The malicious package leaks sensitive environment information such as the installer's IP address and DNS resolver to an attacker-controlled domain during installation. This can lead to reconnaissance by threat actors, potentially enabling further targeted attacks or exploitation. No direct code execution or system compromise beyond this information leakage is described.

Users and organizations should avoid installing the '@heartlandone-private/fontawesome-pro' package versions 6.3.3 and 6.3.6 from public npm registries. There is no official patch or fix available. Review and restrict npm registry configurations to prevent resolution of private-scoped packages from public registries. Monitor dependency sources carefully to avoid dependency confusion attacks. Patch status is not yet confirmed — check vendor advisories or npm security notices for updates.