The hyperion-react-native-testapp npm package declares a preinstall lifecycle script in its package.json that runs a wget command during installation. This command sends environment information including the installer's username, current working directory, and hostname as URL query parameters to a hardcoded webhook.site URL. This exfiltration occurs unconditionally on npm install, without user consent or awareness. The package name pattern and beacon behavior align with dependency confusion proof-of-concept activity, but the data leakage is genuine and exposes sensitive environment details to an external collector controlled by the attacker.

The vulnerability results in unauthorized disclosure of environment information from the system performing the npm install, including username, working directory, and hostname. This can aid attackers in profiling the target environment and potentially facilitate further attacks. No direct code execution or system compromise beyond data leakage is described. There are no known exploits in the wild at this time.

No official patch or remediation is currently available. Users should avoid installing the hyperion-react-native-testapp package, especially versions 1.0.0 and >=10.0.0, until the package is verified clean or removed from repositories. Review and audit npm packages before installation to detect suspicious lifecycle scripts. Consider using package integrity verification tools and restricting installation of untrusted packages.