The @kite-js-tools/core npm package version 1.0.0 includes preinstall and postinstall scripts that execute automatically when the package is installed. The preinstall script sends an HTTPS GET request to a Project Discovery Interactsh (OAST) subdomain, embedding the installer's hostname and process PID in the URL path. The postinstall script performs a DNS resolution to a similarly constructed subdomain, leaking the same host identifiers via DNS. These callbacks to attacker-controlled infrastructure allow confirmation of code execution and exfiltration of identifying data from the compromised host during installation.

Installation of version 1.0.0 of @kite-js-tools/core results in leakage of the installer's hostname and process ID to an attacker-controlled endpoint. This can be used by attackers to confirm successful code execution on the target system and gather identifying information about the compromised machine. There is no indication of further payload execution or system compromise beyond this data exfiltration in the provided information.

No official patch or remediation is currently documented. Users should avoid installing version 1.0.0 of @kite-js-tools/core. Verify package integrity before installation and consider using trusted package sources or alternatives. Monitor vendor advisories for updates or official fixes. Since this is a malicious package behavior, removal of the package and investigation of affected systems is recommended if installed.