The package @itsreduxtm/unpkg-xss-test (versions 1.0.5 and 1.0.9) declares payload.js as its main entry point, which runs an immediately invoked function expression (IIFE) upon loading. This code fetches a wordlist of Linux binary names from a remote source and issues concurrent HEAD HTTP requests to a third-party domain for each binary name. The requests originate from the installer's machine and IP address, effectively using the installer's environment to perform unauthorized reconnaissance scanning. The package name and the use of a GTFOBins-style wordlist suggest this is a browser XSS-delivered path-enumeration payload, but it also executes in Node.js environments (Node 18+ where fetch is global). This covert activity can lead to the installer's IP being flagged or blocked and may result in legal consequences due to unauthorized scanning.

The impact is primarily on the users who install this package. Their machines and IP addresses are used without consent to perform unauthorized scanning of a third-party site. This can lead to the installer's IP address being blacklisted, receiving abuse reports, or facing legal complaints. There is no indication that the package itself compromises the installer's system beyond this misuse of network identity.

No official patch or remediation is indicated in the provided data. Users should avoid installing or remove the affected versions (=1.0.5 and =1.0.9) of @itsreduxtm/unpkg-xss-test. Since this is a malicious package, the best mitigation is to not use it and to audit dependencies for similar malicious behavior. Monitor for updates from the package repository or vendor advisories for any official remediation.