The kdrive-utils package at version 99.9.9 is a malicious npm package that includes a preinstall lifecycle script which automatically runs on installation. This script performs an HTTP request to an attacker-controlled domain, embedding the hostname and username of the compromised system, facilitating supply-chain reconnaissance and potential further exploitation. The package is designed as a dependency confusion attack, using a high version number to override internal packages. It contains no legitimate code beyond this beaconing behavior. According to the source advisories, any system with this package installed should be treated as fully compromised.

Installation of this package results in immediate disclosure of system hostname and username to an attacker-controlled server. The presence of this package indicates a full compromise, potentially allowing attackers to execute arbitrary code or maintain persistence. All secrets and keys on the affected system are at risk and should be rotated. Removal of the package alone does not guarantee elimination of all malicious artifacts or backdoors.

There is no official patch or fix available for this malicious package. The recommended mitigation is to immediately remove the kdrive-utils package version 99.9.9 from all affected systems. Treat any system with this package installed as fully compromised and perform a thorough incident response, including rotating all secrets and keys from a separate, trusted system. Monitor for any signs of further compromise. Patch status is not applicable as this is a malicious package rather than a vulnerability in legitimate software.