The karapace-docs npm package version 1.0.1 includes a malicious preinstall script that runs index.js during installation. This script gathers detailed host identity and local system file contents, including /etc/passwd and /etc/hosts, and transmits this information to a hardcoded Burp Collaborator subdomain (n6usddpvkn7jcauar9va0xvleck48uwj.oastify.com) via HTTPS POST. The package name is designed to resemble a legitimate karapace documentation package, consistent with a dependency confusion or typosquatting attack vector. The data exfiltration happens automatically on npm install without requiring user interaction, potentially compromising the confidentiality of the installer's system information.

Sensitive system information such as hostname, username, home directory, DNS server list, and critical system files (/etc/passwd and /etc/hosts) is exfiltrated to an attacker-controlled endpoint during package installation. This can lead to privacy breaches and may facilitate further targeted attacks against the compromised system or network. The attack leverages the npm package installation process, affecting any user who installs this specific malicious package version.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing karapace-docs version 1.0.1 from untrusted sources. Verify package authenticity before installation and prefer official or well-known package repositories. Monitor for suspicious network activity during npm installs. Since this is a malicious package rather than a vulnerability in legitimate software, removal of the package and investigation of affected systems is recommended if installed.