The 'js-shared-modules' package at version 1.11.7 includes a postinstall script ('node poc.js') that executes automatically during npm install. This script collects the hostname of the installing machine, hex-encodes it, and sends it via HTTPS GET request to a known malicious domain (zcpesvvighyuzqlzkqgdydwp9jn54hfeg.oast.fun), which acts as an out-of-band callback for data exfiltration. The package exports an empty module and appears to be a dependency confusion proof-of-concept squatting on a generic internal package name. The presence of this package indicates a malicious attempt to leak host information and potentially compromise the system.

Installation of this package results in the exfiltration of the installer's hostname to a malicious external server. According to the source, any system with this package installed or running should be considered fully compromised, implying that attackers may have gained control or foothold on the system. All secrets and keys stored on the compromised system should be rotated immediately from a separate, trusted environment. Removing the package alone may not fully remediate the compromise due to potential persistence mechanisms.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove the 'js-shared-modules' package version 1.11.7 from all affected systems. Additionally, treat any affected system as fully compromised: rotate all secrets and keys from a different, secure machine. Conduct a thorough investigation and remediation of the affected environment to ensure no further malicious presence remains.