Malicious code in kmf-vendor-pack (npm)

The 'kmf-vendor-pack' npm package at version 99.0.0 includes a postinstall script that executes a Node.js command to perform an HTTPS GET request to a malicious external server. This request transmits sensitive host-identifying information such as the operating system hostname and the username of the user installing the package. The communication occurs automatically during 'npm install' without any user prompt, confirming remote code execution on the installer's machine and data leakage to a third-party server associated with malicious activity. The package is flagged as malicious by the OpenSSF Package Analysis project and Amazon Inspector.

Installation of this package results in automatic execution of malicious code that leaks sensitive host information to an attacker-controlled domain. This compromises user privacy and system confidentiality by exposing identifying details of the host environment. Although no direct exploit code or further payloads are described, the unauthorized code execution and data exfiltration represent a significant security risk.

No patch or remediation is currently documented for this package. Users should avoid installing 'kmf-vendor-pack' version 99.0.0. Verify package authenticity before installation and consider removing the package if already installed. Monitor for updates or advisories from the package maintainers or security authorities for further guidance.