Malicious code in karma-proxy (npm)

The karma-proxy npm package version 1.0.0 includes a postinstall lifecycle script that unconditionally collects system and environment information (os.hostname(), platform, architecture, Node.js version, package name, lifecycle event) and transmits it to a hardcoded external URL (https://e14giapf.instances.poc.jchunt.top/karma-proxy). This endpoint is controlled by the package author and is unrelated to any official npm registry or vendor infrastructure. The data exfiltration happens silently on every installation without user opt-in or notification, constituting malicious behavior embedded in the package.

This behavior results in unauthorized collection and transmission of potentially sensitive host environment data to an attacker-controlled server. While no direct code execution beyond the postinstall script is described, the privacy breach and potential for further exploitation through this data leakage pose a security risk to users installing this package.

No official patch or remediation is currently documented. Users should avoid installing karma-proxy version 1.0.0. Consider removing the package if already installed and monitor for updates or advisories from the package maintainers or npm registry. Since the package is not a cloud service, remediation depends on user action. Check vendor or npm advisories for any updates or removal notices.